bd0rk has reported a security issue in STphp EasyNews PRO, which can be exploited by malicious people to disclose sensitive information.

The security issue is caused due to incorrect permissions on "data/users.txt", which can be exploited to disclose certain sensitive information, e.g. usernames, email addresses, and password hashes of all users.

The security issue is reported in version 4.0. Other versions may also be affected.

Solution
Restrict web access to the "data/users.txt" file.

Provided and/or discovered by
bd0rk

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/3039

Deep Links
Links available in Customer Area