CVE-2017-17876
HighSummary
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.
Risk Assessment
Attackers may gain access to sensitive files, potentially leading to data leaks and breaches of employee privacy.
Recommendation
It is recommended to update the system to the latest version and implement additional security measures to restrict file access.
Other vulnerabilities in Biometric Shift Employee Management System 3.0
See all- CVE-2017-17990High
The Biometric Shift Employee Management System has a CSRF vulnerability in index.php in the edit_holiday action.
- CVE-2017-17992Critical
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
Original NVD description (English source)
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.