Oraculo Credentials | Ecuador
ODINT's Ecuador cyber tour maps exposed government infrastructure, tax APIs, shared CMS credentials, public GitLab code, and 26.25 GB of evidence.
- Record
- INV-565050
- Status
- published
- Assets
- 0
- Documents
- 0
- Map
- Not included
Oraculo Credentials
Oraculo Plugin — Exposed Credentials
Hardcoded Credentials
Password: SNAPsitio30v
Salt: ALRTOPER984TNMGDGFDH
Used in MCrypt encrypt()/decrypt() functions for data encryption between the oraculo centralized management server and individual government WordPress sites.
Impact
The Sitio-32 theme with oraculo plugin is deployed across ALL Ecuador government WordPress sites including:
- presidencia.gob.ec (Presidency)
- vicepresidencia.gob.ec (Vice Presidency)
- comunicacion.gob.ec (Government Communications)
- ecu911.gob.ec (Emergency Services)
- arcotel.gob.ec (Telecom Regulator)
- aduana.gob.ec (Customs)
- And potentially hundreds more .gob.ec domains
The shared password and salt could allow:
- Decryption of all data encrypted by the oraculo plugin
- Forgery of encrypted payloads to inject content
- Combined with SQL injection vectors in the same theme, full database compromise
SQL Injection Vectors
ajax_selects.php
$id = $_POST['identificador'];
"...where relacion=" . $id . "..."
procesarContacto.php
$nombre = $_POST['nombre'];
"INSERT INTO contacto (nombre, apellido, cedula...) VALUES('$nombre','$apellido'..."
Additional Findings
- MCrypt is deprecated since PHP 7.1 (removed in PHP 7.2)
- No CSRF protection on form handlers
- No input validation/sanitization
- Unsafe email headers allowing header injection
- Mobile-Detect 2.8.17 bundled (older version)