CVE-2022-26646
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
Online Banking System Protect v1.0 contains a local file inclusion (LFI) vulnerability via the pages parameter. This allows an attacker to read sensitive files on the server.
Risk Assessment
The risk involves potential disclosure of confidential data such as configuration files or credentials, which could lead to further attack escalation.
Recommendation
It is recommended to immediately update the system to the latest version or apply security patches. Also restrict access to the pages parameter and validate input data.
Other vulnerabilities in Online Banking System Protect
See all- CVE-2022-26645Critical
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
- CVE-2022-26644Medium
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
Original NVD description (English source)
Online Banking System Protect v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the pages parameter.