Description
HarikaOnline 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for harikaonline.mdb.
References
- harikaonline-harikaonline-info-disclosure(31339) vdb-entry
- 20070107 HarikaOnline v2.0 Remote Password Disclosure Vulnerability mailing-list
- 33410 vdb-entry
- 2125 third-party-advisory