Description
OhhASP stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/OhhASP.mdb.
References
- ohhasp-ohhasp-info-disclosure(31342) vdb-entry
- 20070106 ohhASP Remote Password Disclosure mailing-list
- 33381 vdb-entry
- http://64.38.62.221/ariasecucom/forum/showthread.php?t=89