medium5.0Public exploit code
CVE-2005-2075
PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PHP-Fusion 6.00.105 - Accessible Database Backups Download2005-06-25 · webapps · php · Verified
Impact
PHP-Fusion 5.0 and 6.0 stores the database file with a predictable filename under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information via a direct request to the filename in the administration/db_backups directory in PHP-Fusion 6.0 or the fusion_admin/db_backups directory in 5.0.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Php Fusion | Php Fusion | Versions 5.0, 6.0 |