CVE-2004-2608

Vulnerability

SmartWebby Smart Guest Book stores the Microsoft Access database file SmartGuestBook.mdb (referred to as the "news database") directly under the web document root. The server does not enforce access controls on this file, making it publicly downloadable. This affects all versions of Smart Guest Book as of the publication date (2004-12-31) [1].

Exploitation

An attacker with network access to the web server can simply request the file via HTTP, e.g., http://target/SmartGuestBook.mdb. No authentication or special privileges are required. The file is served directly because the web server is configured to serve static files from the document root.

Impact

Successful retrieval of the database file reveals sensitive information, including the administrator's username and password stored in plaintext (unencrypted). This could allow the attacker to log in to the guest book administration panel and potentially modify or delete entries, or gain further access to the server if the credentials are reused.

Mitigation

No official patch or fixed version has been identified in the available references. As a workaround, administrators should move the SmartGuestBook.mdb file outside the web document root or configure the web server to deny access to .mdb files. The product may be end-of-life; upgrading to a more secure guest book application is recommended.