Description
Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file.
Exploits (1)
exploitdb
WRITEUP
VERIFIED
by Tamer Sahin · textwebappsphp
https://www.exploit-db.com/exploits/20538
References (3)
Core 3
Core References
Exploit, Patch, Vendor Advisory mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/155897
Exploit, Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/2198
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/5934
Scores
EPSS
0.0791
EPSS Percentile
92.1%
Details
Status
published
Products (1)
basilix/basilix_webmail
0.9.7_beta
Published
Jan 11, 2001
Tracked Since
Feb 18, 2026