R00tCr4ck has discovered two vulnerabilities in Web Forum Server, which can be exploited to disclose sensitive information.

1) An input validation error makes it possible for malicious people to access arbitrary files outside the web root via directory traversal attacks.

2) User credentials are stored in clear text in the "Username.ini" file, which is readable by any local user on the system.

The vulnerabilities have been confirmed in version 2.0. Other versions may also be affected.

Solution
Filter malicious characters and character sequences in a proxy or firewall with URL filtering capabilities and grant only trusted users access to the server.
Further details available in Customer Area

Provided and/or discovered by
R00tCr4ck

Deep Links
Links available in Customer Area