Description
SimpNews 2.41.03 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download arbitrary .inc files via a direct request, as demonstrated by admin/includes/dbtables.inc.
References
- simpnews-dbtables-information-disclosure(36778) vdb-entry
- 20070925 SimpNews version 2.41.03 File Content Disclosure Vulnerability mailing-list
- http://forum.boesch-it.de/viewtopic.php?t=2791
- 3173 third-party-advisory
- 45479 vdb-entry
- 20070925 SimpNews version 2.41.03 File Content Disclosure Vulnerability mailing-list
- http://www.netvigilance.com/advisory0069