CVSS base score
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
What the vulnerability does
WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the controller parameter in tblight.php. Attackers can supply path traversal sequences through the controller GET parameter to include arbitrary files outside the intended controllers directory.
Explanation of Vulnerability in Simple Terms
A local vulnerability in cab-fare-calculator versions 1.0.3 allows an attacker with local system access to read sensitive information. The vulnerability requires no authentication or user interaction. The exact nature of the information exposure depends on the application's data handling. Site administrators should update to a version newer than 1.0.3 when available.
What an attacker can do
Read sensitive data on the local system where the application is installed.
Potential impact on your site
If this application processes payment or user data, a local attacker could access that information without needing a user account.
Conditions required to exploit
Local access to the system running cab-fare-calculator; no authentication required.
Key dates
External resources
Related vulnerabilities
