CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in choicehomemortgage AI Mortgage Calculator allows PHP Local File Inclusion. This issue affects AI Mortgage Calculator: from n/a through 1.0.1.
Explanation of Vulnerability in Simple Terms
The AI Mortgage Calculator contains a code injection vulnerability affecting versions up to 1.0.1. An authenticated attacker with low privileges can inject and execute arbitrary code on the server, potentially compromising the entire application and any data it processes. The vulnerability requires network access and high attack complexity but does not require user interaction.
What an attacker can do
Run arbitrary code on the server and access or modify sensitive data.
Potential impact on your site
Attackers with low-privilege accounts can execute code, steal mortgage data, or compromise the entire application.
Conditions required to exploit
Attacker must have low-level authenticated access to the application.
Key dates
External resources
Related vulnerabilities
