CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia – Montpellier Task Manager task-manager allows PHP Local File Inclusion.This issue affects Task Manager: from n/a through <= 3.0.2.
Explanation of Vulnerability in Simple Terms
Task Manager versions 3.0.2 and earlier contain a code injection vulnerability that allows authenticated users with low privileges to execute arbitrary code on the server. The vulnerability requires high attack complexity but grants full read, write, and availability impact once exploited. Administrators should update to a version newer than 3.0.2 immediately.
What an attacker can do
Run their own code on the server and read or modify any data the application can access.
Potential impact on your site
Any low-privilege user account can compromise the entire application and underlying server.
Conditions required to exploit
Attacker must have a low-privilege user account and network access to the application.
Key dates
External resources
Related vulnerabilities
