Summary
On pages displaying ROMs that use ScreenScraper as the source for box art, the link to the ScreenScraper source exposes user passwords in plain text.
Details
On certain ROMs page, there is link at the bottom right that reads "Cover art provided by ScreenScraper" and which redirects to the image source on the Screenscraper.fr website. However, the URL contains four query parameters that were used for scraping but should not appear publicly: devid, devpassword, ssid and sspassword.
PoC
[REDACTED]
Impact
Any user who relied on ScreenScraper to scrap ROMs metadata and then shared access to their RomM instance should consider that their ScreenScraper password has been compromised.
Summary
On pages displaying ROMs that use ScreenScraper as the source for box art, the link to the ScreenScraper source exposes user passwords in plain text.
Details
On certain ROMs page, there is link at the bottom right that reads "Cover art provided by ScreenScraper" and which redirects to the image source on the Screenscraper.fr website. However, the URL contains four query parameters that were used for scraping but should not appear publicly:
devid,devpassword,ssidandsspassword.PoC
[REDACTED]
Impact
Any user who relied on ScreenScraper to scrap ROMs metadata and then shared access to their RomM instance should consider that their ScreenScraper password has been compromised.