CVE-2010-0123 The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a dat...
MediumCVSS 5.0
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The database backup implementation in Employee Timeclock Software 0.99 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for a "semi-predictable file name."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| timeclock-software employee timeclock software | = 0.99 | No fix listed |
References
- 38739 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- 62833 vdb-entry
- 20100310 Secunia Research: Employee Timeclock Software Backup Information Disclosure mailing-list
- timeclock-database-info-disclosure(56798) vdb-entry