An unauthenticated information disclosure vulnerability in Statping-ng version 0.91.0 poses a significant risk to sensitive system data.

This vulnerability involves an improper implementation of access controls within the admin parameter, which allows an unauthenticated remote attacker to retrieve sensitive information from the application.

The ability for an unauthenticated user to extract sensitive information can lead to a compromise of system credentials, configuration details, or other proprietary data. Given the CVSS score of 7.5, this high-severity vulnerability could facilitate further unauthorized access or lateral movement within the network. The resulting data exposure may lead to significant operational disruption and potential reputational damage.

Immediate Action: Since a specific patch is not currently identified, users should restrict network access to the Statping-ng administrative interface to authorized IP addresses only.

Proactive Monitoring: Security teams should audit web server access logs for unusual requests targeting the admin parameter and monitor for spikes in outbound traffic from the Statping-ng instance.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing suspicious payloads directed at the admin endpoint.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub repository provided by the vulnerability researcher.

Due to the public availability of a proof-of-concept and the high-severity nature of this information disclosure, immediate protective measures are required. Administrators must prioritize isolating the affected component from the public internet and implementing strict access controls until a permanent vendor-supplied patch is made available.