M.Hasran Addahroni has discovered a security issue in Clever Copy, which can be exploited by malicious people to disclose sensitive information.

The security issue is caused due to improper restrictions to "admin/connect.inc", which contains the user credentials to access the MySQL database.

Successful exploitation requires that ".inc" is not declared as a php suffix in httpd.conf.

The security issue has been confirmed in version 3.0. Other versions may also be affected.

Solution
Restrict web access to "admin/connect.inc" (e.g. with a .htaccess file).

Provided and/or discovered by
M.Hasran Addahroni

Changelog
Further details available in Customer Area

Original Advisory
http://advisories.echo.or.id/adv/adv28-K-159-2006.txt

Deep Links
Links available in Customer Area