Secunia

drG4njubas has discovered a security issue in Web Wiz Site News, which can be exploited by malicious people to disclose sensitive information.

The problem is that the admin password is stored in an unprotected MS Access database file.

The file is called "news.mdb" and is by default placed in the "news" folder together with all the public scripts.

The security issue has been confirmed in version 3.0.6. Prior versions may also be affected.

Solution
The security issue has been fixed in version 3.0.7 by informing users that the "news.mdb" database file should be placed outside the web root in a secure location.

Provided and/or discovered by
drG4njubas

Changelog
Further details available in Customer Area

Original Advisory
http://www.blacktigerz.org/filez/advisory010.txt

Deep Links
Links available in Customer Area