CVE:CVE-2009-4465
CNNVD:CNNVD-200912-404
DeluxeBB在访问权控制不力的web根目录下储存敏感信息。远程攻击者可以借助对(1) templates/ including (2) templates/deluxe/admincp/, (3) templates/corporate/admincp/, 和 (4) templates/blue/admincp/; (5) images/; (6) logs/ including (7) logs/cp.php; (8) wysiwyg/; (9) docs/; (10) classes/; (11) lang/; 和 (12) settings/的脚本的一个直接请求，获得用户和设置信息,登录数据,并获得管理访问权。
solution:Upgrade deluxebb deluxebb to a higher version than 1.3,and avoid the version 1.3