Midicart ASP - Remote Customer Information Retrieval

Author: Dimitri Sekhniashvili
type: webapps
platform: asp
port: nan
date_added: 2002-08-10 
date_updated: 2012-10-03 
verified: 1 
codes: CVE-2002-1432;OSVDB-15971 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5438/info

Midicart ASP is a commercially available e-commerce solution distributed by Coxco Support. It is available for the Microsoft Windows operating system.

The default installation of Midicart ASP does not place sufficient access control on the midicart.mdb file. Due to this lack of access control, it is possible for a remote user to gain access to this file. This file may yield sensitive customer information, such as customer names, addresses, and credit card information.

http://www.example.com/shoppingdirectory/midicart.mdb