2

I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains:

<database>
    <jndi-name>jdbc/mysql</jndi-name>
    <driver> 
        <type>com.mysql.jdbc.jdbc2.optional.MysqlConnectionPoolDataSource</type> 
        <url>jdbc:mysql://127.0.0.1:3306/[domainWasHere]</url>
        <user>[userWasHere]</user>
        <password>[passWasHere]</password>
    </driver>
</database>

Could this be vital information in the wrong hands?

1

Could it? Yes.

Is it? That's less certain. If your MySQL server is configured properly, it isn't accessible from the Internet at large, and the credentials are useless to anyone who doesn't have the ability to run code on the server.

Of course, this assumes that the username and password are unique to the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.