HTMLJunction EZGuestbook Guestbook.mdb Database Disclosure Vulnerability

Bugtraq ID:	13543
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 07 2005 12:00AM
Updated:	May 07 2005 12:00AM
Credit:	Discovery is credited to g0rellazz G0r <[email protected]>.
Vulnerable:	HTMLJunction EZGuestbook
Not Vulnerable:

HTMLJunction EZGuestbook Guestbook.mdb Database Disclosure Vulnerability

HTMLJunction EZGuestbook is prone to a database disclosure vulnerability. Remote users may download the database file 'guestbook.mdb' and gain access to sensitive information. The attacker would carry out this attack by directly requesting the database file through an HTTP GET request.

HTMLJunction EZGuestbook Guestbook.mdb Database Disclosure Vulnerability

No exploit is required.

The following proof of concept is available:
http://www.example.com/ezguestbook/datastores/guestbook.mdb

HTMLJunction EZGuestbook Guestbook.mdb Database Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HTMLJunction EZGuestbook Guestbook.mdb Database Disclosure Vulnerability

References:

• EZGuestbook Homepage (HTMLJunction)