Description
toendaCMS before 0.6.2 stores user account and session data in the web root directory, which allows remote attackers to obtain sensitive information via a direct request to the appropriate XML file.
References
- 17471 third-party-advisory
- ADV-2005-2343 vdb-entry
- 20051107 SEC Consult SA-20051107-0 :: toendaCMS multiple vulnerabilites mailing-list