Fara Rustein

The issue allows attackers to obtain sensitive information, including the database connection and email connection passwords, by reading the HTML source code of the database connection and email settings page.

The issue is related to a format string vulnerability in the client. This vulnerability can be exploited by remote servers, potentially leading to a denial of service (crash) or the execution of arbitrary code. The exploitation occurs through format string specifiers in the Remote File field.

The issue allows remote attackers to conduct phishing attacks without detection by the victim, as the `security/MemberLoginForm.php` in the affected version supports login using a GET request.