Description
Micro Login System 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a file containing a password via a direct request for userpwd.txt.
References
- 20071026 Micro Login System v1.0 (userpwd.txt) Password Disclosure Vulnerability mailing-list
- 27422 third-party-advisory
- 40641 vdb-entry
- 26246 vdb-entry
- 3328 third-party-advisory