The w3-msql CGI script provided with Mini SQL allows remote attackers to view restricted directories.