CVE-2024-31556: 
PHP vulnerability analysis and mitigation

A vulnerability has been identified in Reportico Web before version 8.1.0 that allows a local attacker to execute arbitrary code and obtain sensitive information through the sessionid function. The vulnerability was discovered and disclosed on May 14, 2024, and is tracked as CVE-2024-31556. The issue affects all versions of Reportico Web prior to version 8.1.0 (NVD).

The vulnerability is related to improper privilege management and has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires local access, has low attack complexity, requires low privileges, needs no user interaction, and can result in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability allows attackers to execute arbitrary code and access sensitive information through the sessionid function. The high CVSS score indicates severe potential impacts on system security, including complete compromise of system confidentiality, integrity, and availability (NVD).

The vulnerability requires local access to exploit, with low attack complexity and low privilege requirements. No user interaction is necessary for exploitation, making it relatively straightforward for an attacker with local access to leverage (NVD, GitHub Issue).

Users should upgrade to Reportico Web version 8.1.0 or later, which contains fixes for this vulnerability. The issue has been addressed in the latest release (NVD).