CVE-2009-0250

CVE-2009-0250 describes a critical information disclosure vulnerability in Ryneezy phoSheezy 0.2, where sensitive administrator password hashes are stored in a publicly accessible file under the web root. This allows unauthenticated remote attackers to directly download the config/password file, compromising administrator credentials. The vulnerability has a CVSS score of 5.0, indicating a medium severity, and is easily exploitable with low attack complexity and no authentication required. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an ExploitDB entry (EDB-7780) exists for a related remote command execution vulnerability in a later version, suggesting potential for similar exploit development. Community discussion and media coverage for this specific CVE are minimal.