Description
FubarForum 1.6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing user credentials via a direct request for user.tsv.
References
- 20090317 [ECHO_ADV_107$2009] FubarForum <= 1.6 Critical File Disclosure Vulnerability mailing-list
- 34358 third-party-advisory
- http://e-rdc.org/v1/news.php?readmore=131