HSC MailInspector Local File Inclusion Vulnerability Allowing Arbitrary File Read

A local file inclusion (LFI) vulnerability has been identified in HSC MailInspector version 5.3.3-7. This vulnerability arises from inadequate validation and sanitization of user-supplied file paths in the endpoint '/vendor/phpunit/phpunit.php'. The flaw allows remote attackers to exploit path traversal techniques to access and read arbitrary files from the server's operating system and application directories, potentially leading to unauthorized disclosure of sensitive information.

Impact

Exploitation of this vulnerability could allow attackers to read sensitive files from the server, such as credentials, API keys, or database connection details. This information could be used to gain insight into the server's internal architecture or to facilitate more severe attacks.