Description
A local file inclusion (LFI) vulnerability exists in ActualAnalyzer Lite version 2.78. The application does not properly validate file path parameters, allowing inclusion of arbitrary local files.
Impact
An attacker can read arbitrary files from the server, including configuration files containing database credentials, log files, and other sensitive data. In some configurations, this can lead to code execution.
Solution
Apply strict input validation to file path parameters. Upgrade to the latest version.