CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice allows PHP Local File Inclusion.This issue affects Easy Invoice: from n/a through <= 2.1.4.
Explanation of Vulnerability in Simple Terms
Easy Invoice versions up to 2.1.4 contain a code injection vulnerability that allows high-privileged users to execute arbitrary code on the server. The vulnerability requires administrator-level access and high attack complexity to exploit. An attacker with admin credentials can read sensitive data, modify site content, or disrupt service availability.
What an attacker can do
Execute arbitrary code on the server to read data, modify content, or disable the site.
Potential impact on your site
A compromised admin account could lead to full site compromise, data theft, or service disruption.
Conditions required to exploit
Administrator-level access to the site; high attack complexity suggests specific conditions or configuration required.
Key dates
External resources
Related vulnerabilities
