Description
The installation helper db.php in NooMS 1.1 stays reachable after setup and takes the database host, user, and password straight from the request through the g_dbhost, g_dbuser, and g_dbpwd parameters. It then reports whether the connection succeeded, and it applies no rate limit on attempts.
Impact
An attacker can point the script at the local MySQL server and use it as an oracle to guess database passwords at high speed. A successful guess gives direct access to the site database.
Solution
Delete db.php after installation, or restrict access to it and stop taking connection credentials from request parameters.