Description
Openforum stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user passwords via a direct request for openforum.mdb.
References
- 20070102 Openforum Remote password Disclosure mailing-list
- openforum-openforum-password-disclosure(31209) vdb-entry
- 33366 vdb-entry
- http://www.aria-security.com/forum/showthread.php?t=80
- 2099 third-party-advisory