Description
A local file inclusion (LFI) vulnerability exists in Sava's Place Guestbook through index.php. The application does not properly validate the file path parameter, allowing inclusion of arbitrary local files.
Impact
An attacker can read arbitrary files from the server, including configuration files with database credentials and other sensitive information.
Solution
Apply strict input validation to file path parameters. Use a whitelist approach for included files.