Simple PHP Blog (sphpBlog) 0.4.0 stores the (1) password.txt and (2) config.txt files under the web document root, which allows remote attackers to obtain sensitive information and crack passwords via a direct request to these files.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Sphpblog | Sphpblog | 0.4_.0 (including) | 0.4_.0 (including) |
References
- http://echo.or.id/adv/adv12-y3dips-2005.txt
- http://marc.info/?l=bugtraq\u0026m=111359320312609\u0026w=2
- http://www.waraxe.us/ftopict-651.html
- http://echo.or.id/adv/adv12-y3dips-2005.txt
- http://marc.info/?l=bugtraq\u0026m=111359320312609\u0026w=2
- http://www.waraxe.us/ftopict-651.html