CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designervily Karzo karzo allows PHP Local File Inclusion.This issue affects Karzo: from n/a through < 2.6.
Explanation of Vulnerability in Simple Terms
Karzo versions 2.6 and earlier contain a vulnerability that allows an attacker to read sensitive data, modify content, or disrupt service without authentication. The attack requires specific network conditions but no user interaction. All installations of affected versions should update immediately.
What an attacker can do
Read sensitive data, modify content, or disrupt the service without logging in.
Potential impact on your site
Attackers can access private data, alter site content, or cause downtime without needing valid credentials.
Conditions required to exploit
Network access to the Karzo installation; no authentication required.
Key dates
External resources
Related vulnerabilities
