https://www.exploit-db.com/exploits/24317
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-418

ASPRunner2.4版本将web根下的数据库存于db目录。远程攻击者可以借助对数据库文件名的直接请求获得数据库，该漏洞基于表和字段名进行预测。

source: http://www.securityfocus.com/bid/10799/info
  
ASPRunner is reported prone to multiple vulnerabilities. The reported issues include SQL injection, cross-site scripting, information disclosure and unauthorized access to database files.
  
ASPRunner versions 2.4 and prior are affect by these issues.

http://www.example.com/db/[DB-FILE-NAME]

来源:BID
名称:10799
链接:http://www.securityfocus.com/bid/10799
来源:SECUNIA
名称:12164
链接:http://secunia.com/advisories/12164
来源:BUGTRAQ
名称:20040726ASPRunnerMultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=109086977330418&w;=2
来源:ferruh.mavituna.com
链接:http://ferruh.mavituna.com/article/?574
来源:VULNWATCH
名称:20040726ASPRunnerMultipleVulnerabilities
链接:http://archives.neohapsis.com/archives/vulnwatch/2004-q3/0011.html
来源:XF
名称:asprunner-database-file-access(16802)
链接:http://xforce.iss.net/xforce/xfdb/16802
来源:OSVDB
名称:8253
链接:http://www.osvdb.org/8253
来源:SECTRACK
名称:1010777
链接:http://securitytracker.com/id?1010777