Skip to main content

Local file inclusion

Description

The application allows to read or execute files located on the server through relative paths manipulation in the input fields.

Impact

  • Visualize the content of sensitive files stored on the server.
  • Get sensitive data.
  • Read system files.

Recommendation

  • Validate that the parameters received by the application do not contain relative paths.
  • Disable insecure functions that allow reading of arbitrary files on the server.

Threat

Unauthorized attacker from local network.

Expected Remediation Time

โŒš 120 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: N
  • User interaction: N
  • Scope: C
  • Confidentiality: H
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 8.6
    • Temporal: 8.6
  • Severity:
    • Base: High
    • Temporal: High

Requirements