uguestbook exploit

[l--s@hotmail.com]

hello ,

By ...... MeSa7eB

Data ...... 28/7/2005

pro ...... http://www.uapplication.com/

My web site : http://3asfh.net/vb

My Email : l--s@hotmail.com

===============================================

exploit :

http://xxx.com/guestbook/mdb-database/guestbook.mdb

==================================

[Earnhart, Benjamin J]

That's not a product-specific exploit or a flaw in the product. =20

If somebody mis-configures their installation of it by putting the
database file in a directory accessible via the web, then getting the
database file is trivial for any package. The very first step in the
documentation for uguestbook says not to do that, see:
http://www.uapplication.com/uguestbook/doc.asp =20


> -----Original Message-----
> From: l--s@hotmail.com [mailto:l--s@hotmail.com]=20
> Sent: Thursday, July 28, 2005 10:31 AM
> To: bugtraq@securityfocus.com
> Subject: uguestbook exploit
>=20
> hello ,=20
>=20
> By ...... MeSa7eB
>=20
> Data ...... 28/7/2005
>=20
> pro ...... http://www.uapplication.com/
>=20
> My web site : http://3asfh.net/vb
>=20
> My Email : l--s@hotmail.com
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
>=20
> exploit :=20
>=20
> http://xxx.com/guestbook/mdb-database/guestbook.mdb=20
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
>=20

[security curmudgeon]

: pro ...... http://www.uapplication.com/
:
: My web site : http://3asfh.net/vb
:
: My Email : l--s@hotmail.com
:
: exploit :
:
: http://xxx.com/guestbook/mdb-database/guestbook.mdb

This was disclosed on 2005-04-28 by "rida rida" <l8oo8l@msn.com> via
SecurityTracker.

http://securitytracker.com/alerts/2005/Apr/1013830.html