CVE-2007-1192

Thomas R. Pasawicz HyperBook Guestbook 1.30 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download an admin password hash via a direct request for data/gbconfiguration.dat.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2007-03-02

Last modified

2024-08-07

Affected products

• Guestbook (Hyperbook)

References

• http://downloads.securityfocus.com/vulnerabilities/exploits/22754.py
• http://osvdb.org/33868
• http://secunia.com/advisories/24392
• http://www.securityfocus.com/bid/22754