FAC Guestbook db/gdb.mdb and db/gbdb.mdb information disclosure
| facguestbook-gdb-gbdb-information-disclosure (33600) |  Medium Risk |
Description:
FAC Guestbook could allow a remote attacker to obtain sensitive information, caused by improper permissions on the db/gdb.mdb and db/gbdb.mdb database files. A remote attacker could exploit this vulnerability to obtain the administrator's password and other sensitive information.
Platforms Affected:
- FAC Guestbook, FAC Guestbook 2.0
- FAC Guestbook, FAC Guestbook 3.01
Remedy:
No remedy available as of June 27, 2009.
Consequences:
Obtain Information
References:
- BugTraq Mailing List, Thu Apr 12 2007 - 00:18:16 CDT , FAC GuestBook v2.0 remote database disclosure vulnerability at http://archives.neohapsis.com/archives/bugtraq/2007-04/0203.html.
- SourceForge.net, FAC Guestbook at http://sourceforge.net/projects/facgb/.
- BID-23441: FAC Guestbook Database Information Disclosure Vulnerability
- CVE-2007-2100: FAC Guestbook 2.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/Gdb.mdb.
- CVE-2007-2101: FAC Guestbook 3.01 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/gbdb.mdb. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- SA24872: FAC Guestbook Database Disclosure Security Issue
Reported:
Apr 12, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net