Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Professional Download Assistant lets attackers download database

CVE-2008-5572 · published 17 years ago
Summary

The Professional Download Assistant version 0.1 saves its database file in a publicly accessible web folder without proper protection. This means anyone on the internet can request the file and obtain sensitive information stored there. Update the software or move the database to a secure location that is not directly reachable from the web.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
dotnetindex professional_download_assistant 0.1
cpe:2.3:a:dotnetindex:professional_download_assistant:0.1:*:*:*:*:*:*:*
Original advisory text
Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct reques...
Professional Download Assistant 0.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download the database file via a direct request for database/downloads.mdb.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
7% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published15 Dec 2008
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2008-5572 · NVD
Track software like this
Free during beta