CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in adamskaat Countdown & Clock countdown-builder allows Remote Code Inclusion.This issue affects Countdown & Clock: from n/a through <= 2.8.8.
Explanation of Vulnerability in Simple Terms
A path traversal vulnerability in Countdown & Clock versions 2.8.8 and earlier allows an authenticated attacker to read, modify, or delete arbitrary files on the server. The vulnerability requires low-level user privileges and network access. An attacker can exploit this to access sensitive configuration files, database credentials, or other protected data stored on the site.
What an attacker can do
Read, modify, or delete arbitrary files on the server, including sensitive configuration and database files.
Potential impact on your site
Complete compromise of site data, credentials, and potentially the underlying server if sensitive files are accessed or modified.
Conditions required to exploit
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
