A vulnerability in the Premierturk Excavation Management Information System allows authenticated attackers to access private directories and expose sensitive personal information, posing a significant data privacy risk.

This vulnerability involves improper access control, specifically categorized as CWE-552 (Files or Directories Accessible to External Parties) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). Based on the CVSS vector (PR:L), the flaw requires a low-privileged authenticated user to trigger the exposure.

The exposure of private personal information can lead to severe regulatory non-compliance, loss of customer trust, and potential legal repercussions regarding data protection standards. With a CVSS score of 8.1, the vulnerability is classified as High severity, reflecting the significant impact on data confidentiality and integrity. If exploited, an attacker could harvest sensitive records, leading to unauthorized data exfiltration and potential misuse of private information.

Immediate Action: Organizations must update the Excavation Management Information System to version 10.2025.01 or later immediately upon vendor release.

Proactive Monitoring: Security teams should review application access logs for unusual patterns of directory traversal or unauthorized requests to sensitive endpoints that contain personal data.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and block requests attempting to access sensitive file paths or directory listings that should be restricted.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS score and the sensitive nature of the information exposed, this vulnerability presents a significant risk to data privacy. Administrators should prioritize the application of vendor-supplied patches as soon as they become available. Until the update is deployed, ensure that access controls for the application are strictly enforced and that all internal users operate under the principle of least privilege to minimize the potential for exploitation.