CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite allows PHP Local File Inclusion.This issue affects EventON: from n/a through <= 2.4.
Explanation of Vulnerability in Simple Terms
EventON versions 2.4 and earlier contain a code injection vulnerability that allows attackers to execute arbitrary code on the site. The vulnerability requires user interaction—typically a victim must click a malicious link or visit a crafted page. An attacker can read sensitive data, modify site content, or disrupt service availability.
What an attacker can do
Execute arbitrary code on the site, read sensitive data, modify content, or disrupt availability.
Potential impact on your site
Site could be fully compromised, with attacker gaining ability to steal data, deface content, or take the site offline.
Conditions required to exploit
Victim must click a malicious link or visit an attacker-controlled page; no authentication required.
Key dates
External resources
Related vulnerabilities
