Description
download.php in the MuddyDogPaws FileDownload snippet before 2.5 for MODx allows remote attackers to download arbitrary files, as demonstrated by downloading config.inc.php to obtain database credentials.
References
- ADV-2007-0426 vdb-entry
- 23953 third-party-advisory
- http://modxcms.com/forums/index.php/topic%2C10470.0.html
- http://www.muddydogpaws.com/Home.html
- 22327 vdb-entry