Description
Tuan Do Uploader (aka php-uploader) 6 beta 1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the administrator password hash via a direct request for userdata/user_1.txt.
References
- uploader-userdata-info-disclosure(31683) vdb-entry
- 20070122 Uploader <= (userdata/user_1.txt) Password Disclosure Vulnerability mailing-list
- 2187 third-party-advisory