Description
Z-Blog 1.7 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for zblog.mdb.
References
- ADV-2007-2060 vdb-entry
- zblog-zblog-information-disclosure(34673) vdb-entry
- 20070601 Z-Blog 1.7 Authentication Bypass Database Download Vulnerability mailing-list
- 2776 third-party-advisory
- 39739 vdb-entry