CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wdesco Advanced Online Ordering and Delivery Platform advanced-online-ordering-and-delivery-platform allows PHP Local File Inclusion.This issue affects Advanced Online Ordering and Delivery Platform: from n/a through <= 2.0.0.
Explanation of Vulnerability in Simple Terms
The Advanced Online Ordering and Delivery Platform contains a code injection vulnerability affecting versions up to 2.0.0. An attacker on the network can inject and execute arbitrary code without authentication or user interaction. This allows complete compromise of the platform's confidentiality, integrity, and availability. The attack requires high technical complexity but no prior access.
What an attacker can do
Execute arbitrary code on the platform and access or modify all data.
Potential impact on your site
Complete compromise of the ordering platform, including customer data theft, order manipulation, and service disruption.
Conditions required to exploit
Network access to the platform; no authentication required.
Key dates
External resources
Related vulnerabilities
