Secunia

DarkFig has reported a security issue in Foros, which can be exploited by malicious people to disclose sensitive information.

The problem is caused due to improper restrictions to "inc/config.inc", which contains the user credentials to access the MySQL database and the administration section.

Successful exploitation requires that ".inc" is not declared as a php suffix in httpd.conf.

The security issue has been reported in 1.0. Other versions may also be affected.

Solution
Restrict web access to "inc/config.inc" (e.g. with a .htaccess file).

Provided and/or discovered by
DarkFig

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area