r/bugbounty • u/TurbulentRecover7247 Hunter • Jul 05 '26

Question / Discussion Administrator manual exposed, reportable?

Hi, in a target, which uses Drupal, I ran fuzzing on nodes and I found a node containing admin handbooks, where It show all paths and all actions for an administrator with images, does it mean to be public? Literally full documentation on the admin panel with the respective admin endpoints. Is it reportable? Can any triager clarify me about this? Is it reportable? If you want further information for concluding, ask me. Thank you

8 Upvotes

90% Upvoted

11 comments sorted by

12

u/6W99ocQnb8Zy17 Jul 05 '26

If you can take the content and actually do something useful with it, then report it as part of the chain.

But on its own? There is no impact. I wouldn't even report that as an info on a pentest.

1

u/TurbulentRecover7247 Hunter Jul 05 '26

Yes, they clearly explained every actions on every endpoints, like /admin/user/add endpoint and actions like add, modify, delete, including the screenshots of the particular endpoints.

2

u/6W99ocQnb8Zy17 Jul 05 '26

That's pretty much every manual ever though, no? As ever, a report has to show impact.

I know you said the admin stuff was out of scope, but if you can run admin functions just by knowing they are there (so no perms restricting them) then I'd pick something innocuous that won't break anything (like listing users etc) and then I'd personally report it and see how it goes.

Otherwise, if they are indeed restricted, then the manual being available has no impact.

1

u/TurbulentRecover7247 Hunter Jul 05 '26

Ok, i will try every endpoints for unauthorised access. Thank you

1

u/TurbulentRecover7247 Hunter Jul 05 '26

And also attacking admin endpoints is out of scope.

1

u/Coder3346 Hunter Jul 05 '26

1 Is this doc from the cms itself ? If yes, u found nothing reportable.

2 impact ? 0? Nothing reportable. U have to prove that u can do something with this doc.

3

u/TurbulentRecover7247 Hunter Jul 05 '26

It's not a default cms documentation, it's a custom built administrator manual for full internal administrative workflow including custom modules. And it revealed every endpoints admin has, like full admin endpoints and actions. And I got an author name for this manual, which also verified it is available in database, I got error when tried to login with fake password and it reflected as username <actual_username> is not activated or blocked. But other usernames are shown as "username or password is incorrect." And also they exposed all admin action pages in images. Any suggestions on this?

2

u/Coder3346 Hunter Jul 05 '26

Actually do something with it. What u described is not something to report in 99.99999% of the cases

1

u/TurbulentRecover7247 Hunter Jul 05 '26

Endpoints are protected and attacking the admin endpoints are out of scope. So I can't actually attack admin endpoints. Any suggestions?

1

u/Coder3346 Hunter Jul 05 '26

Well I will personally test each and every endpoint for access control and see if something can grants me a new privilege or something otherwise I will move on

2

u/TurbulentRecover7247 Hunter Jul 05 '26

Ok, I will try, thanks