Description
CarbonCommunities stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for DataBase/Carbon2.4d.mdb.
References
- http://aria-security.com/forum/showthread.php?t=85
- 37549 vdb-entry
- carboncommunities-carbon2-info-disclosure(31253) vdb-entry
- ADV-2007-0038 vdb-entry