Description
PhpMyFaq 1.5.1 stores data files under the web document root with insufficient access control and predictable filenames, which allows remote attackers to obtain sensitive information via a direct request to the data/tracking[DATE] file.
References
- 16933 third-party-advisory
- 14930 vdb-entry
- 19670 vdb-entry
- http://rgod.altervista.org/phpmyfuck151.html
- 20050922 PhpMyFAQ 1.5.1 multiple vulnerabilities mailing-list
- phpmyfaq-log-user-information-disclosure(22405) vdb-entry
- 1014968 vdb-entry