Description
Employee Timeclock Software 0.99 places the database password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
References
- 20100310 Secunia Research: Employee Timeclock Software "mysqldump" Password Disclosure mailing-list
- 38739 third-party-advisory
- http://secunia.com/secunia_research/2010-12/
- 62830 vdb-entry
- timeclock-mysqldump-info-disclosure(56800) vdb-entry
- 38642 vdb-entry