{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Subject Advisory Submission",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "AliReza"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# Exploit Title: EZ Game Booster v1.0.0 - Cleartext Credentials in user.config\n# Date: 2026-07-16\n# Exploit Author: Alireza Chegini\n# Vendor Homepage: https://ezsystemrepairs.com\n# Software Link: https://ezsystemrepairs.com (Free version available)\n# Version: 1.0.0 (v2.0 exists but not tested - paid license required)\n# Tested on: Windows 10 / Windows 11\n# CVE: Pending\n============================================================\n\n1. Description\n   EZ Game Booster v1.0.0 stores user credentials (username, password,\n   email, licenseKey) in plaintext within a .NET user.config file.\n   This is a CWE-312 vulnerability allowing local credential theft.\n\n2. Affected File Path\n   C:\\Users\\%USERNAME%\\AppData\\Local\\ezgamebooster\\\n   ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\\1.0.0.0\\user.config\n\n3. Exposed Fields (stored in cleartext)\n   - username\n   - password\n   - email\n   - fullname\n   - licenseKey\n   - machineCode\n\n4. Sample user.config Structure\nThe following is the exact content of the user.config file found on\nthe researcher\u2019s system:\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003cconfiguration\u003e\n\u003cuserSettings\u003e\n\u003cezgamebooster.My.MySettings\u003e\n\u003csetting name=\"username\" serializeAs=\"String\"\u003e\n\u003cvalue\u003enimaarek\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"password\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eCanYouSeeMyPassword?!\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"machineCode\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eN414NBC****BDBMB\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"role\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eFree\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"active\" serializeAs=\"String\"\u003e\n\u003cvalue\u003e2026-07-15 16:38:52\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"created_at\" serializeAs=\"String\"\u003e\n\u003cvalue\u003e2026-07-15 16:38:52\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"email\" serializeAs=\"String\"\u003e\n\u003cvalue\u003enim44r3k () gmail com\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"fullname\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eAliReza Chegini\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"subinfo\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eBasic\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"usernameChanged\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eTrue\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"rememberMe\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eTrue\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"licenseKey\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eA325-****-B084-****\u003c/value\u003e\n\u003c/setting\u003e\n\u003csetting name=\"isLoggedIn\" serializeAs=\"String\"\u003e\n\u003cvalue\u003eFalse\u003c/value\u003e\n\u003c/setting\u003e\n\u003c/ezgamebooster.My.MySettings\u003e\n\u003c/userSettings\u003e\n\u003c/configuration\u003e\n\n5. Impact\n   - Credential theft via local file read\n   - Credential stuffing attacks on other platforms\n   - License key theft for unauthorized activation\n\n6. Steps to Reproduce\n   a. Install and run EZ Game Booster v1.0.0\n   b. Create an account or log in\n   c. Browse to: %LOCALAPPDATA%\\ezgamebooster\\\n      ezgamebooster_Url_fgj2qz5coiw33xftcp3agaqkgxc51bkk\\1.0.0.0\\\n   d. Open user.config with Notepad\n   e. Observe plaintext password, email, and licenseKey\n\n7. Remediation\n   Encrypt sensitive data using DPAPI before serialization.\n   Use Windows Credential Manager for credential storage.\n\n8. Author\u0027s Note on Discovery\n   \"I discovered this while uninstalling the software and checking for\n   leftover files. I was not performing any targeted security research\n   at the time \u2014 I simply found my credentials in plaintext by accident.\"\n\n\nBest regards,\nAliReza Chegini - nimaarek\nnim44r3k () gmail com - priv8 () tuta io\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-312",
              "description": "CWE-312",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:22Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/21"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/21"
        },
        {
          "url": "https://ezsystemrepairs.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/21"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Subject: Advisory Submission: EZ Game Booster - Cleartext Storage of Sensitive Credentials (CWE-312)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0103",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/21",
            "automated": true,
            "contentSha256": "80227aec16dd9d88bf81836efb7b5f4713a56899de1337982b61deee3e06b5a3",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/21",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-16T01:47:06Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:22Z",
    "dateUpdated": "2026-09-07T13:20:22Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0103"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}