CVE-2010-0984 in Acidcat
Summary
by MITRE
Acidcat CMS 3.5.3 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing credentials via a direct request for databases/acidcat_3.mdb.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/02/2026
The vulnerability identified as CVE-2010-0984 affects Acidcat CMS versions 3.5.3 and earlier, representing a critical security flaw in web application configuration and access control mechanisms. This issue stems from improper file placement and permission settings within the web server environment, creating a pathway for unauthorized information disclosure that directly compromises system security. The vulnerability manifests when sensitive database files are stored in directories accessible through the web root, eliminating proper access restrictions that should protect confidential information.
The technical flaw resides in the application's improper handling of database file storage and access control policies. The database file acidcat_3.mdb containing user credentials and other sensitive information is stored in a location accessible via standard web requests, bypassing normal authentication mechanisms. This configuration violates fundamental security principles of least privilege and proper resource isolation, allowing remote attackers to directly access the database through simple HTTP requests without requiring valid authentication credentials or session tokens. The vulnerability specifically targets the databases/ directory within the web root, which should never contain sensitive files that are directly accessible by unauthenticated users.
The operational impact of this vulnerability is severe and multifaceted, as it provides attackers with immediate access to a complete database containing user credentials, potentially leading to full system compromise. Remote attackers can exploit this weakness to obtain administrative credentials, user account information, and other sensitive data stored within the database. This exposure creates opportunities for privilege escalation, lateral movement, and persistent access within the compromised environment, making it particularly dangerous for organizations relying on this content management system. The vulnerability effectively eliminates the need for complex attack vectors, as the database is directly accessible through simple web requests.
Security professionals should address this vulnerability through immediate remediation actions including proper file access control configuration, database file relocation outside the web root, and implementation of appropriate authentication mechanisms. The recommended mitigation strategies include moving database files to non-web-accessible directories, implementing proper access control lists, and configuring web server permissions to prevent direct access to sensitive files. This vulnerability aligns with CWE-275 permissions issues and represents a clear violation of the principle of least privilege. From an ATT&CK framework perspective, this vulnerability maps to T1078 valid accounts and T1566 credential access, as it enables attackers to obtain valid credentials through direct database access rather than traditional attack methods. Organizations should also implement regular security assessments and automated scanning to identify similar misconfigurations in other web applications and systems.