CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Chris Gardenberg EduAdmin Booking eduadmin-booking allows PHP Local File Inclusion.This issue affects EduAdmin Booking: from n/a through <= 5.2.0.
Explanation of Vulnerability in Simple Terms
EduAdmin Booking versions up to 5.2.0 contain a path traversal vulnerability that allows authenticated users to read, write, or delete files on the server outside the intended directory. An attacker with low-level access can exploit this to access sensitive configuration files, modify application data, or disrupt service availability. The vulnerability requires network access and some attack complexity but poses significant risk to site integrity and confidentiality.
What an attacker can do
Read, write, or delete files anywhere on the server outside the intended application directory.
Potential impact on your site
Attackers with basic user accounts can access sensitive files, modify data, or crash the application.
Conditions required to exploit
Attacker must have a low-privilege user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
