CVE-2010-0978 in Guestbook
Summary
by MITRE
KMSoft Guestbook (aka GBook) 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for db/db.mdb.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability described in CVE-2010-0978 affects KMSoft Guestbook version 1.0, a web-based guestbook application that was widely used for managing visitor comments on websites. This particular flaw represents a critical security weakness in the application's file access control mechanisms and demonstrates poor security practices in web application development. The vulnerability stems from the application's improper handling of sensitive data storage and access permissions, creating an exploitable condition that directly compromises the confidentiality of stored information.
The technical flaw involves the application's storage of database files in directories accessible through the web root, specifically storing the database file db/db.mdb in a location that does not enforce proper access controls. This configuration allows unauthorized users to directly request the database file through a simple HTTP GET request without authentication or authorization checks. The vulnerability is classified as a weakness in access control mechanisms, specifically falling under CWE-284 which addresses improper access control, and represents a direct violation of the principle of least privilege in security design. The flaw enables attackers to bypass normal application authentication and authorization procedures, gaining direct access to sensitive data stored in the database.
The operational impact of this vulnerability is severe and multifaceted, as it allows remote attackers to obtain complete database contents without requiring any credentials or authentication. This exposes all guestbook entries, including potentially sensitive visitor information such as names, email addresses, IP addresses, and posted comments. The vulnerability can be exploited from any location with internet access, making it particularly dangerous for web applications deployed in production environments. According to ATT&CK framework, this represents a technique categorized under T1213 (Data from Information Repositories) and T1071.004 (Application Layer Protocol: DNS) when combined with other reconnaissance activities, as attackers can systematically discover and exploit such misconfigurations.
The vulnerability can be exploited using simple tools such as web browsers or command-line utilities like curl or wget, requiring no specialized knowledge or advanced techniques. Attackers can directly access the database by navigating to the URL pattern that corresponds to the database file location, effectively bypassing all application-level security controls. This flaw demonstrates a fundamental lack of security awareness in the application's development lifecycle, particularly in the areas of secure coding practices and security testing. The issue represents a classic example of insecure direct object reference vulnerability where the application exposes internal file paths directly to external users without proper access controls.
Mitigation strategies for this vulnerability should focus on immediate remediation of the access control configuration and implementation of proper file access restrictions. The primary fix involves moving the database file outside the web root directory and implementing proper access controls through authentication mechanisms or web server configuration. Organizations should also implement proper input validation and output encoding practices to prevent similar issues in other parts of their applications. The remediation should include regular security assessments and penetration testing to identify and address similar misconfigurations. Additionally, implementing proper logging and monitoring of database access attempts can help detect and respond to exploitation attempts, while following security standards such as OWASP Top Ten and NIST guidelines for secure web application development practices would prevent similar vulnerabilities from occurring in future implementations.