Description
The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable file name."
References
- 38739 third-party-advisory
- 20100310 Secunia Research: Employee Timeclock Software Backup Information Disclosure mailing-list
- 62833 vdb-entry
- http://secunia.com/secunia_research/2010-10/
- timeclock-database-info-disclosure(56798) vdb-entry