Microsoft Project Server 2003 PDSRequest.ASP XML请求信息泄露漏洞

Microsoft Project server 2003实现部分瘦客户端功能，瘦客户端使用XML请求对HTTPS服务进行对话。 这些请求其中一个返回用于访问SQL数据库的MSProjectUser帐户的用户名和密码信息： -------------------------------------------------------------- POST http://SERVER/projectserver/logon/pdsrequest.asp HTTP/1.0 Accept: / Accept-Language: en-nz Pragma: no-cache Host:...

CVE-2006-6617: Undefined Security Weakness

projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote authenticated users to obtain the MSProjectUser password for a SQL database via a GetInitializationData request, which includes the information in the UserName and Password tags of the response...