Likes: 0
hello ,
By ...... MeSa7eB
Data ...... 28/7/2005
pro ...... http://www.uapplication.com/
My web site : http://3asfh.net/vb
My Email : l--s@hotmail.com
===============================================
exploit :
http://xxx.com/guestbook/mdb-database/guestbook.mdb
==================================
That's not a product-specific exploit or a flaw in the product. =20
If somebody mis-configures their installation of it by putting the
database file in a directory accessible via the web, then getting the
database file is trivial for any package. The very first step in the
documentation for uguestbook says not to do that, see:
http://www.uapplication.com/uguestbook/doc.asp =20
> -----Original Message-----
> From: l--s@hotmail.com [mailto:l--s@hotmail.com]=20
> Sent: Thursday, July 28, 2005 10:31 AM
> To: bugtraq@securityfocus.com
> Subject: uguestbook exploit
>=20
> hello ,=20
>=20
> By ...... MeSa7eB
>=20
> Data ...... 28/7/2005
>=20
> pro ...... http://www.uapplication.com/
>=20
> My web site : http://3asfh.net/vb
>=20
> My Email : l--s@hotmail.com
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
>=20
> exploit :=20
>=20
> http://xxx.com/guestbook/mdb-database/guestbook.mdb=20
>=20
> =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
>=20
: pro ...... http://www.uapplication.com/
:
: My web site : http://3asfh.net/vb
:
: My Email : l--s@hotmail.com
:
: exploit :
:
: http://xxx.com/guestbook/mdb-database/guestbook.mdb
This was disclosed on 2005-04-28 by "rida rida" <l8oo8l@msn.com> via
SecurityTracker.
http://securitytracker.com/alerts/2005/Apr/1013830.html
Quote