Description
lblog stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a certain file in admin/db/newFolder/.
References
- lblog-newfolder-information-disclosure(31229) vdb-entry
- 2098 third-party-advisory
- 20070102 lblog Remote Password Disclosure mailing-list
- 1017462 vdb-entry
- 33367 vdb-entry
- http://www.aria-security.com/forum/showthread.php?t=79