LuxCal v2.7.0 Multiple Remote Vulnerabilities
LuxCal v2.7.0 is vulnerable to multiple remote vulnerabilities, including Local File Inclusion, Information Disclosure, XSS, and phpinfo(). The Local File Inclusion vulnerability can be exploited by sending a specially crafted HTTP request containing directory traversal characters (e.g. “../”) to the vulnerable application. This will allow an attacker to download the source code of the application. The Information Disclosure vulnerability can be exploited by sending a specially crafted HTTP request to the vulnerable application. This will allow an attacker to view the encrypted information of the database. The XSS vulnerability can be exploited by sending a specially crafted HTTP request containing malicious JavaScript code to the vulnerable application. This will allow an attacker to execute arbitrary JavaScript code in the context of the vulnerable application. The phpinfo() vulnerability can be exploited by sending a specially crafted HTTP request to the vulnerable application. This will allow an attacker to view the configuration information of the application.
