Note-A-Day-2.1.txt

`New eVuln Advisory:  
Note-A-Day Weblog Sensitive Information Disclosure  
http://evuln.com/vulns/44/summary.html  
  
--------------------Summary----------------  
  
Software: Note-A-Day  
Sowtware's Web Site: http://noteaday.com/  
Versions: 2.1  
Critical Level: Moderate  
Type: Sensitive Information Disclosure  
Class: Remote  
Status: Unpatched  
Exploit: Available  
Solution: Not Available  
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)  
eVuln ID: EV0044  
  
-----------------Description---------------  
Directory "archive" is not protected by htaccess in default installiation. This can be used to retrieve registered user's information including encrypted passwords.  
  
--------------Exploit----------------------  
Available at: http://evuln.com/vulns/44/exploit.html  
  
Admin's encrypted password:  
  
http://host/noteday/archive/.phpass-admin  
  
  
--------------Solution---------------------  
No Patch available.  
  
--------------Credit-----------------------  
Discovered by: Aliaksandr Hartsuyeu (eVuln.com)  
`