JGBBS 3.0beta1 Version Search.ASP "Author" SQL Injection Exploit

JGBBS 3.0beta1 Version Search.ASP "Author" SQL Injection Exploit Type : SQL Injection Release Date : 2007-03-13 Product / Vendor : JGBBS Is a Tree-style Online Forum System http://sourceforge.net/projects/jgbbs/ Bug : http://localhost/script/search.asp?author=-SQL Inj.-&bid=0 SQL Injection Exploi...

CVE-2007-0089

jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/bbs.mdb...

CVE-2007-0089

jgbbs stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct request for db/bbs.mdb...

CVE-2007-0089

CVE-2007-0089 concerns jgbbs leaving a sensitive database under the web root with insufficient access control. Remote attackers can retrieve the database file (db/bbs.mdb), exposing passwords via a direct request. The vulnerability stems from inadequate separation between web-accessible content a...

jgbbs

ARIA-SECURITY TEAM Forum: http://aria-security.com DiscoveredBy:t3rr0r1st from Aria-Security Type:Remote Password Disclosure Vendor:http://sourceforge.net/projects/jgbbs/ PoC: http://target/path/db/bbs.mdb Contact: [email protected] http://aria-security.com/forum/showthread.php?t=87...