Lucene search

K
exploitdbTamer SahinEDB-ID:20538
HistoryJan 11, 2001 - 12:00 a.m.

Basilix Webmail 0.9.7 - Incorrect File Permissions

2001-01-1100:00:00
Tamer Sahin
www.exploit-db.com
17

AI Score

7.4

Confidence

Low

source: https://www.securityfocus.com/bid/2198/info

A vulnerability has been reported in basilix webmail v. 0.9.7b.

Basilix Webmail ships with several configuration files that have the file extensions '.class' and '.inc'. Among other things, these files contain the authentication information for the MySQL database that the product uses.

These files reside in directories accessible via http. If the webserver is not configured to treat .class and .inc files as PHP scripts,they can be retrieved by remote users.

Properly exploited, this information can allow further attacks on the affected host.

http://target/class/mysql.class
http://target/inc/sendmail.inc (settings.inc and etc.) 

AI Score

7.4

Confidence

Low

Related for EDB-ID:20538