HotPlug CMS stores sensitive information under the web root with insufficient access control, which allows remote attackers to read the admin password and database credentials via a direct request for includes/class/config.inc.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hotplug_cms | Hotplug_cms | * | * |