Description
Katrien De Graeve a.shopKart 2.0 (aka ashopKart20) stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) admin/scart.mdb and possibly (2) admin/scart97.mdb.
References
- 20060602 new bug mailing-list
- 20485 third-party-advisory
- 1009549 vdb-entry
- 1025 third-party-advisory
- 26237 vdb-entry
- ADV-2006-2208 vdb-entry
- ashopkart-database-file-access(15599) vdb-entry