Description
listpics 5 stores sensitive data under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for listpics.mdb.
References
- ADV-2006-4847 vdb-entry
- 20061202 listpics v5 mailing-list
- listpics-mdb-information-disclosure(30713) vdb-entry
- 23210 third-party-advisory