CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclusion.This issue affects DyaPress ERP/CRM: from n/a through <= 18.0.2.0.
Explanation of Vulnerability in Simple Terms
DyaPress ERP/CRM versions up to 18.0.2.0 contain a path traversal vulnerability that allows an attacker to read, write, or delete files on the server outside the intended directory. The vulnerability requires network access but no authentication or user interaction. An attacker can exploit this to access sensitive configuration files, database credentials, or other protected data stored on the server.
What an attacker can do
Read, write, or delete files anywhere on the server filesystem without authentication.
Potential impact on your site
Attackers can steal database credentials, configuration files, or other sensitive data; modify or delete critical files; or potentially compromise the entire server.
Conditions required to exploit
Network access to the DyaPress instance; no authentication or user interaction required.
Key dates
External resources
