Description
Sven Moderow GuestBook 0.3a stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for (1) gbook97.mdb or (2) gbook.mdb in ~db/.
References
- http://aria-security.com/forum/showthread.php?p=114
- 20070103 GuestBook v0.3a Remote Password Disclosure mailing-list
- 2105 third-party-advisory
- 33363 vdb-entry
- guestbook-gbook-information-disclosure(31245) vdb-entry