CVE-2006-6973 Information

Description

Headstart Solutions DeskPRO does not require authentication for certain files and directories associated with administrative activities which allows remote attackers to (1) reinstall the application via a direct request for install/index.php; (2) delete the database via a do=delete_database QUERY_STRING to a renamed copy of install/index.php; or access the administration system after guessing a filename via a direct request for a file in (3) admin/ or (4) tech/.

Reference

http://www.zion-security.com/text/Mul_Vulnerability_DeskPro.txt