Description
WineGlass stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/data.mdb.
References
- ADV-2007-0037 vdb-entry
- 23594 third-party-advisory
- 32575 vdb-entry
- 20070103 WineGlass "data.mdb" Remote Password Disclosure mailing-list
- http://aria-security.com/forum/showthread.php?p=112