[CO] 860MB AVICOLAELMADRONO.COM

avicolaelmadrono.com is the public commercial and institutional website for Avícola El Madroño S.A., a Colombian poultry company based in Bucaramanga. It features the company's presentation, a product catalog (including chicken, sausages, pre-cooked meals, and Christmas products), recipes, store locations, and online ordering by city. The data is from June 2026, and it is completely free for everyone.


The investigation begins at PHP 7.4.32 - phpinfo(). The page loads without any authentication. It is a PHP diagnostic file that exposes the full server configuration. From it I record the machine name (svrlaravel), its internal IP address (192.168.10.242), the web root (/var/www/), the PHP version (7.4.32), the administrator email cristian.quiroga@avicolalemadrono.com, and the presence of both MySQL and PostgreSQL.

Going up one level to Index of /backoffice, Apache does not return a normal web page but a full directory listing. This is directory listing, enabled through the mod_autoindex module. I identify six entries: egresoscorreos/, madrono/, piku/, sanmarino/, sanmarinobk/, and phpinfo.php. This listing makes it possible to browse the tree without knowing URLs in advance, and that is how the exploration continues.

The egresoscorreos/ folder is the first one opened. Again the listing is active and several files are readable directly. UFTE203B.TXT is about 1.3 MB: it contains complete accounting data with people's names, ID numbers, and payment amounts from the Uno system at Avicola El Madrono. pruebaegresos.txt holds the same kind of test payment data. In the archivoscargados/ subfolder I find dozens of files uploaded through the upload form, including one named 1e1446_clientes_none.php dated November 2023.

The madrono/, piku/, sanmarino/, and sanmarinobk/ folders each lead to an admin/ directory with a login form titled "FORMULARIO DE ACCESO", which posts credentials to validar_usuario.php. The addresses soporte@avicolaelmadrono.com and avicampo@avicolaelmadrono.com are displayed on those pages.

The uploadegresos.php script in egresoscorreos/ then shows that the upload mechanism is open: a POST request sent without an active session still triggers a server response, including a MySQL connection attempt ending in a "No route to host" error. The form works without prior authentication, which explains the files present in archivoscargados/.

When I load the backup home page (El Madroño S.A.), I extract the list of hosted applications: mmovil.madronoapp.com, backup2.madronoapp.com, the ERP, Calidad, PESV, and internal IP addresses (200.116.208.84, 200.116.208.85, 201.221.132.93). That page centralizes access to the wider infrastructure.

At this point I download locally everything exposed: phpinfo.php, the accounting files, the PHP scripts, the contents of archivoscargados/, and the admin pages.

To go further, I resolve DNS for the subdomains listed on the home page. backup.madronoapp.com points to 200.116.209.20madronoapp.com to 200.116.209.19mmovil.madronoapp.com to 200.116.209.21, and backup2.madronoapp.com to 181.57.129.166. On each of these hosts I test the /phpmyadmin/ URL and obtain a publicly reachable login page on all four instances: backup (version 4.6.6), madronoapp.com (PMA 4.0.x), backup2 (version 5.2.1), and mmovil (version 4.6.6).

I then try common login/password combinations on each instance. On backup, mmovil, and backup2, no connection succeeds. On madronoapp.com, the combination root / root opens the full phpMyAdmin panel. I load server_databases.php to confirm: 18 databases are accessible (activos, avicampo, avicampo2, bna, cadasa, calidadm, documentos, documentos_ambiental, documentos_mi_granja, informes, ocsweb, pesv, pesv_avicampo, pesv_granja, piku, sanmarino, ticket_madrono, unoweb).

Opening db_structure.php?db=avicampo shows 91 tables, including CLAVES, CLIENTES, CONSECUT, LOTES, and MTBODEGA. From the mysql.user table I export 20 MySQL accounts with their password hashes; two accounts have empty passwords (avicampo2@localhost and pedidosUser@localhost). The results are stored in phpmyadmin/03_mysql_accounts.txt.

I then search for sensitive tables across all databases: user accounts, password fields, login tokens, and similar structures. About 80 table names match. I sample rows from informes.usuarios, avicampo2.tbl_usuario, ticket_madrono.users, and cadasa/sanmarino/piku user tables. Application passwords are stored as MD5 hashes, which is weak by current standards. The extracted samples are saved in phpmyadmin/02_sensitive_tables.txt.

On the backup server, known CVE tests against phpMyAdmin 4.6.6 do not yield further access: CVE-2018-12613 (LFI) is not exploitable here, and /phpmyadmin/setup/ returns 401 on backupmmovil, and madronoapp.com (404 on backup2).

-> Tree <-​

madrono/
├── localhost.sql
├── output/
│ └── backoffice/
│ ├── phpinfo.php
│ ├── egresoscorreos/
│ │ ├── UFTE203B.TXT
│ │ ├── pruebaegresos.txt
│ │ ├── subiregresos.php
│ │ ├── uploadegresos.php
│ │ └── archivoscargados/
│ │ ├── 078bea_clientes_pruebaegresos.txt
│ │ ├── 1659f5_clientes_pruebaegresos.txt
│ │ ├── 1e1446_clientes_none.php
│ │ ├── 1e569c_clientes_pruebaegresos.txt
│ │ ├── 2b394f_clientes_pruebaegresos.txt
│ │ ├── 2d0541_clientes_pruebaegresos.txt
│ │ ├── 42f383_clientes_pruebaegresos.txt
│ │ ├── 46a139_clientes_pruebaegresos.txt
│ │ ├── 477147_clientes_pruebaegresos.txt
│ │ ├── 5c2282_clientes_pruebaegresos.txt
│ │ ├── 5ee10d_clientes_pruebaegresos.txt
│ │ ├── 6f014e_clientes_pruebaegresos.txt
│ │ ├── 714728_clientes_pruebaegresos.txt
│ │ ├── 724115_clientes_pruebaegresos.txt
│ │ ├── 7a6b5a_clientes_pruebaegresos.txt
│ │ ├── 7e9ade_clientes_pruebaegresos.txt
│ │ ├── 8a4fd0_clientes_pruebaegresos.txt
│ │ ├── 8e4a79_clientes_pruebaegresos.txt
│ │ ├── a1f36d_clientes_pruebaegresos.txt
│ │ ├── a72cb1_clientes_pruebaegresos.txt
│ │ ├── b67130_clientes_pruebaegresos.txt
│ │ ├── be162e_clientes_pruebaegresos.txt
│ │ └── e5fa8b_clientes_pruebaegresos.txt
│ └── madrono/
│ └── admin/
│ ├── index.php
│ ├── validar_usuario.php
│ ├── logout.php
│ └── librerias/
│ ├── bootstrap/
│ ├── datatables/
│ ├── font-awesome/
│ └── php-excel/
└── phpmyadmin/
├── 02_sensitive_tables.txt
└── 03_mysql_accounts.txt​

Click to expand...