CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Booking Ultra Pro allows PHP Local File Inclusion.This issue affects Booking Ultra Pro: from n/a through 1.1.13.
Explanation of Vulnerability in Simple Terms
Booking Ultra Pro versions up to 1.1.13 contain a path traversal vulnerability that allows an attacker to read files outside the intended directory. The vulnerability requires user interaction—typically clicking a malicious link—and no authentication. An attacker can access sensitive files like configuration or database backups, but cannot modify or delete them.
What an attacker can do
Read arbitrary files from the server by manipulating file paths.
Potential impact on your site
Sensitive files (config, backups, private keys) may be exposed if accessed through this vulnerability.
Conditions required to exploit
User must click a malicious link or visit an attacker-controlled page; no login required.
Key dates
External resources
Related vulnerabilities
