Local file inclusion
Description
The application allows to read or execute files located on the server through relative paths manipulation in the input fields.
Impact
- Visualize the content of sensitive files stored on the server.
- Get sensitive data.
- Read system files.
Recommendation
- Validate that the parameters received by the application do not contain relative paths.
- Disable insecure functions that allow reading of arbitrary files on the server.
Threat
Unauthorized attacker from local network.
Expected Remediation Time
⌚ 120 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the vulnerability.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: N
- User interaction: N
- Scope: C
- Confidentiality: H
- Integrity: N
- Availability: N
Temporal
- Exploit code madurity: X
- Remediation level: X
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N/E:X/RL:X/RC:X
- Score:
- Base: 8.6
- Temporal: 8.6
- Severity:
- Base: High
- Temporal: High