PHP-Board 1.0 - User Password Disclosure



EKU-ID: 27740 CVE: CVE-2003-1401;OSVDB-58899 OSVDB-ID:
Author: frog Published: 2003-02-15 Verified: Verified
Download:

Rating

☆☆☆☆☆
Home 


source: https://www.securityfocus.com/bid/6862/info

php-board user information is stored in flat files on the system hosting the software. Access to the files via the web is not sufficiently restricted. Remote attackers may request user files and gain access to php-board user and administrative passwords.

http://www.example.com/user/[NICKNAME].txt