My First Medium‑Severity Vulnerability: Exploiting Leaked Test Accounts in an EduCN Portal

The article reports a medium‑severity vulnerability discovered in January on an educational website.

The author employed the Google dork

site:edu.cn intext:"测试账号" "试用账号" filetype:xls|pdf|doc|docx

to search for files that contain test‑account information. The search returned a document listing three test accounts—student, teacher, and admin—each using the password 123456.

The author first attempted common penetration‑testing techniques such as brute‑force password guessing, using a universal SQL password, and exploiting password‑reset logic flaws, but none succeeded in gaining access.

Using the leaked credentials, the author logged in with the highest‑privilege admin (教务) account. The login succeeded, granting full administrative rights, as shown in the following screenshots.

The author concludes that default test accounts with weak passwords constitute an information‑leak vulnerability of medium severity, underscoring the need for educational institutions to remove or secure such accounts to prevent unauthorized access.