A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customer_support/index.php.
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')