Description
Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, which allows remote attackers to gain privileges.
References
- 25689 vdb-entry
- 1016163 vdb-entry
- ADV-2006-1904 vdb-entry
- dayfoxblog-slogusers-information-disclosure(26623) vdb-entry
- http://colander.altervista.org/advisory/DayfoxBlog.txt
- 20216 third-party-advisory