phpMyFAQ

I think I might just be missing something, but it was just pointed out that if a user went to http://www.domain.com/faq/inc/data.php/..namedfork/data it was possible for our mysql password to be visible. I am running an older version of phpfaq (1.3.x) is this an issue with the older version or are ...