PHP Webquest version 2.6 suffers from a vulnerability that allows for database credential extraction.