CVE-2007-0518 Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct....
HighCVSS 7.5
EPSS 2.5%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Scriptsez Smart PHP Subscriber (aka subscribe) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain encoded passwords via a direct request for pwd.txt.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scriptsez smart php subscriber | All versions | No fix listed |
References
- 32946 vdb-entry
- 23886 third-party-advisory vendor-advisory
- 2183 third-party-advisory
- 20070123 subscribe (pwd.txt) Remote Password Disclosur mailing-list
- subscriber-pwd-information-disclosure(31701) vdb-entry