CVE-2023-49544

The Customer Support System v1 is vulnerable to a Local File Inclusion (LFI) flaw via the page= parameter at /customer_support/index.php. An authenticated user can manipulate this parameter to include and read internal PHP files from the operating system, such as db_connect. Evidence shows that a...