CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in trippleS Turitor turitor allows PHP Local File Inclusion.This issue affects Turitor: from n/a through < 1.5.3.
Explanation of Vulnerability in Simple Terms
Turitor versions up to 1.5.3 contain a flaw that allows authenticated users with low privileges to read sensitive data, modify content, or disrupt service. The vulnerability requires network access and specific conditions to exploit, but does not require user interaction. Sites running affected versions should update immediately.
What an attacker can do
Read sensitive data, modify content, or disrupt service on the affected site.
Potential impact on your site
Confidential data may be exposed, site content could be altered, or service availability disrupted by authenticated attackers.
Conditions required to exploit
Attacker must have low-level authenticated access to the application.
Key dates
External resources
