CVE-2008-5885

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The Net Guys ASPired2Quote stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file containing usernames and passwords via a direct request for admin/quote.mdb. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Jan 12, 2009
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2008

CVE-2008-58865.0TAKempis Discussion Web 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers CVE-2008-58875.0phplist before 2.10.8 allows remote attackers to include files via unknown vectors, related to a "local file include vulnerability."CVE-2008-58887.5Multiple SQL injection vulnerabilities in Click&Rank allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) hiCVE-2008-58894.3Cross-site scripting (XSS) vulnerability in user.asp in Click&Rank allows remote attackers to inject arbitrary web script or HTML via the acCVE-2008-58907.5SQL injection vulnerability in feeds.php in Injader before 2.1.2 allows remote attackers to execute arbitrary SQL commands via the id parameCVE-2008-58914.3Cross-site scripting (XSS) vulnerability in the profile editing functionality in Injader before 2.1.2 allows remote attackers to inject arbiCVE-2008-58927.5Multiple SQL injection vulnerabilities in ClickAndEmail allow remote attackers to execute arbitrary SQL commands via (1) the ID parameter toCVE-2008-58932.6Cross-site scripting (XSS) vulnerability in admin_dblayers.asp in ClickAndEmail allows remote attackers to inject arbitrary web script or HTCVE-2008-58946.8Directory traversal vulnerability in index.php in Mediatheka 4.2 allows remote attackers to include and execute arbitrary local files via a CVE-2008-58957.5SQL injection vulnerability in connection.php in Mediatheka 4.2 and earlier allows remote attackers to execute arbitrary SQL commands via thCVE-2008-58967.5CodeAvalanche RateMySite stores sensitive information under the web root with insufficient access control, which allows remote attackers to CVE-2008-58977.5CodeAvalanche FreeWallpaper stores sensitive information under the web root with insufficient access control, which allows remote attackers
CVE-2008-5885: Medium severity, CVSS 5.0 | Vulnix