CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Milan Petrovic GD Rating System allows PHP Local File Inclusion.This issue affects GD Rating System: from n/a through 3.6.
Explanation of Vulnerability in Simple Terms
GD Rating System versions 3.6 and earlier contain a path traversal vulnerability that allows authenticated users to read arbitrary files from the server. An attacker with low-level access can bypass directory restrictions and access sensitive files outside the intended application directory. The vulnerability requires network access and specific conditions to exploit, but does not allow file modification or system compromise.
What an attacker can do
Read arbitrary files from the server filesystem outside the application directory.
Potential impact on your site
Sensitive files (config, database credentials, private keys) may be exposed to authenticated users.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; network access required.
Key dates
External resources
Related vulnerabilities
