CVE-2017-17992
CriticalSummary
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
Risk Assessment
An attacker could gain access to sensitive files on the server, potentially leading to data leaks or other serious security incidents.
Recommendation
It is recommended to implement input validation and restrict file access to prevent unauthorized downloads.
Other vulnerabilities in Biometric Shift Employee Management System
See all- CVE-2017-17990High
The Biometric Shift Employee Management System has a CSRF vulnerability in index.php in the edit_holiday action.
- CVE-2017-17876High
Biometric Shift Employee Management System 3.0 allows remote attackers to bypass intended file-read restrictions via a user=download request with a pathname in the path parameter.
Original NVD description (English source)
Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php form_file_name parameter in a download_form action.