CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Lab lab allows PHP Local File Inclusion.This issue affects Lab: from n/a through <= 1.0.0.
Explanation of Vulnerability in Simple Terms
Lab by Axiom Themes contains a code injection vulnerability affecting versions up to 1.0.0. An attacker with network access can inject and execute arbitrary code without authentication, potentially compromising the entire site. The vulnerability requires specific conditions to exploit but can lead to full system compromise including data theft and malware installation.
What an attacker can do
Run arbitrary code on the site and steal or modify all data.
Potential impact on your site
Complete site compromise, data theft, malware installation, and loss of user trust.
Conditions required to exploit
Network access; specific attack conditions must be met (high complexity).
Key dates
External resources
