Planyo Online Reservation System: file inclusion (LFI/RFI)
Planyo Online Reservation System
File inclusion (LFI/RFI) in the Planyo Online Reservation System component. Threat level: High (CVSS 7.2).
Who is affected
This vulnerability affects: Planyo Online Reservation System. If you use this component on your site, check the version and update it as soon as possible.
How dangerous
Rating: High, CVSS 7.2 out of 10. It is worth acting before the flaw is exploited.
What this flaw is
File inclusion (LFI/RFI) lets an attacker force the site to load a file outside its intended scope, local (e.g. configuration) or remote.
It can expose sensitive configuration files (database credentials) and is often the first step in a chain leading to code execution.
Score breakdown (CVSS vector)
What the CVSS 7.2 rating means in practice:
- The attack can be carried out remotely, over the internet.
- No login or account required.
- Requires no action from the victim.
- The impact may reach beyond the vulnerable component itself.
- At risk: data confidentiality, integrity (data can be altered).
Weakness class: CWE-20.
What to do
- Update the vulnerable component (Planyo Online Reservation System) to the latest version.
- If a patch is not out yet, temporarily disable the vulnerable element.
- Check whether the site has already been attacked: unusual files, new administrator accounts, redirects.
- Make a backup before you start making changes.
Does this flaw affect your site?
We will run a free audit: we check versions, plugins, and configuration, and tell you plainly whether you are safe.
Request a free audit →