TowerBlog versions 0.6 and below allows for remote access of the administrative password hash.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/37107/towerBlog06.txt
Source: https://packetstormsecurity.com/files/37107/towerBlog06.txt.html