ID:4015 - Exploit for Permissions, Privileges, and Access Controls in PHP-Fusion - CVE-2013-1807

Link to public exploit:

Vulnerability description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.

Remediation