CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Help Desk js-support-ticket allows PHP Local File Inclusion.This issue affects JS Help Desk: from n/a through <= 2.9.2.
Explanation of Vulnerability in Simple Terms
JS Help Desk versions up to 2.9.2 contain a remote code execution vulnerability. An attacker can execute arbitrary PHP code on the affected site without authentication. The vulnerability requires specific conditions to exploit but can lead to complete site compromise, including data theft and malware installation.
What an attacker can do
Run their own PHP code on the site and take full control of it.
Potential impact on your site
Complete site compromise: attackers can steal data, install malware, modify content, and create backdoors.
Conditions required to exploit
Network access to the site; no authentication required, but exploitation requires specific conditions.
Key dates
External resources
Related vulnerabilities
