Description
WabCMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/wabcmsn.mdb. NOTE: this issue was originally reported for "webCMS," but this was an error by an unreliable researcher.
References
- 20070531 wrong but true: "webCMS" database disclosure is actually for wabCMS mailing-list
- 25453 third-party-advisory
- http://www.xmors-security.com/advisory/webCMS_1.00.txt
- 20070525 webCMS_1.00 Database Disclosure Vulnerabilitiy mailing-list
- 36698 vdb-entry