CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in moaluko Store Locator store-locator allows PHP Local File Inclusion.This issue affects Store Locator: from n/a through <= 3.98.10.
Explanation of Vulnerability in Simple Terms
Store Locator versions 3.98.10 and earlier contain a path traversal vulnerability that allows an attacker to read or write arbitrary files on the server. The vulnerability requires user interaction and high attack complexity, but successful exploitation grants full read and write access to the site's filesystem, potentially exposing sensitive configuration files or enabling code injection.
What an attacker can do
Read or write arbitrary files on the server, including sensitive configuration and source code.
Potential impact on your site
Attackers could steal database credentials, modify site files, or inject malicious code if they can trick a visitor into triggering the vulnerability.
Conditions required to exploit
User must visit a malicious link or page; no authentication required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
