CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SeventhQueen Kleo kleo allows PHP Local File Inclusion.This issue affects Kleo: from n/a through < 5.5.0.
Explanation of Vulnerability in Simple Terms
Kleo versions up to 5.5.0 contain a remote code execution vulnerability accessible to authenticated users with low privileges. An attacker with a basic user account can execute arbitrary PHP code on the server, potentially compromising the entire site. The vulnerability requires high attack complexity but grants full read, write, and availability impact once exploited.
What an attacker can do
Run their own PHP code on the server and access or modify any site data.
Potential impact on your site
Any registered user can take over the site, steal data, or take it offline.
Conditions required to exploit
Attacker must have a low-privilege user account; no user interaction required.
Key dates
External resources
Related vulnerabilities
