CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows PHP Local File Inclusion.This issue affects Point Maker: from n/a through <= 0.1.4.
Explanation of Vulnerability in Simple Terms
Point Maker versions 0.1.4 and earlier contain a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary code on the server. The vulnerability requires high attack complexity but grants full read, write, and availability impact. Affected installations should update immediately.
What an attacker can do
Run their own code on the server, read sensitive files, modify site data, or cause the site to become unavailable.
Potential impact on your site
Any low-privilege user account can compromise the entire site, including database access and file system control.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
