Secunia

Moudi has discovered a vulnerability in Digital Sales IPN, which can be exploited by malicious people to disclose sensitive information.

The "Database/Sales.mdb" database is stored with insecure permissions inside the web root. This can be exploited to disclose e.g. the administrator user name and password by downloading the file.

The vulnerability is confirmed in a demo version downloaded 2009-01-19. Other versions may also be affected.

Solution
Restrict access to the database file or move it out of the web root.

Provided and/or discovered by
Moudi

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/7816

Deep Links
Links available in Customer Area