CVE-2007-5260 ASP-CMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct req...
MediumCVSS 5.0
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ASP-CMS 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing the username and password via a direct request for mdb-database/ASP-CMS_v100.mdb.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| asp-cms | = 1.0 | No fix listed |
References
- 3199 third-party-advisory
- 20070930 ASP-CMS version 1 default password location. mailing-list