CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through <= 4.12.0.
Explanation of Vulnerability in Simple Terms
Total Poll Lite versions 4.12.0 and earlier contain a code injection vulnerability. An attacker with low-level user privileges can inject and execute arbitrary code on the site without user interaction. The vulnerability affects the entire system due to scope change, allowing full compromise of confidentiality, integrity, and availability.
What an attacker can do
Run arbitrary code on the site with the privileges of the web server.
Potential impact on your site
Complete site compromise: data theft, malware injection, site defacement, or total takeover.
Conditions required to exploit
Attacker must have a low-level user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
