CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce premmerce allows PHP Local File Inclusion.This issue affects Premmerce: from n/a through <= 1.3.19.
Explanation of Vulnerability in Simple Terms
Premmerce versions up to 1.3.19 contain a vulnerability that allows an attacker to read sensitive data, modify site content, or disrupt service. The attack requires user interaction—typically a victim clicking a malicious link—and relies on specific conditions being met. Update to version 1.3.20 or later to patch this issue.
What an attacker can do
Read sensitive data, modify site content, or disrupt service if a user clicks a malicious link.
Potential impact on your site
Users' data could be exposed, site content could be altered, or the site could become unavailable.
Conditions required to exploit
A site visitor must click a link or visit a page controlled by the attacker; no prior authentication required.
Key dates
External resources
