Unauthorized access in midicart

It's possible to obtain full user's database in file midicart.mdb...