Description
AspBB stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for db/aspbb.mdb.
References
- 33364 vdb-entry
- http://www.aria-security.com/forum/showthread.php?t=82
- aspbb-aspbb-info-disclosure(31230) vdb-entry
- 20070102 AspBB Remote Password Disclosure mailing-list
- 2100 third-party-advisory