Basilix Webmail 0.9.7beta and possibly other versions stores *.class and *.inc files under the document root and does not restrict access which could allows remote attackers to obtain sensitive information such as MySQL passwords and usernames from the mysql.class file.