CVE-2006-5197

PDshopPro stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for 1 /pdshoppro.mdb, 2 /data/pdshoppro.mdb, or 3 /shoppro/data/pdshoppro.mdb...

CVE-2006-5197

PDshopPro (CVE-2006-5197) suffers from insufficient access control, exposing the backend database under the web root. A remote attacker can download the database by directly requesting one of: /pdshoppro.mdb, /data/pdshoppro.mdb, or /shoppro/data/pdshoppro.mdb. This is a direct exposure of sensit...