This vulnerability in osuuu LightPicture (versions 1.2.0 through 1.2.2) arises from hard-coded credentials exposed via manipulation of the argument key in the processing of the /public/install/lp.sql file within the API Upload Endpoint. The issue allows an unauthenticated remote attacker to potentially leverage these credentials. The CVSS 4.0 base score is 6.9, indicating a medium severity level. The vendor has not issued a patch or provided remediation information, and the vulnerability was publicly disclosed without vendor response.

The presence of hard-coded credentials can allow remote attackers to gain unauthorized access or perform actions with elevated privileges on the affected system. This could lead to unauthorized data access or modification depending on the privileges associated with the credentials. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider mitigating exposure by restricting access to the vulnerable API Upload Endpoint and monitoring for suspicious activity related to the /public/install/lp.sql file. Avoid deploying affected versions in exposed environments until a fix is available.