CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Kinsley kinsley allows PHP Local File Inclusion.This issue affects Kinsley: from n/a through <= 3.4.4.
Explanation of Vulnerability in Simple Terms
Kinsley versions up to 3.4.4 contain a remote code execution vulnerability. An attacker can execute arbitrary PHP code on the site without authentication. The vulnerability requires specific conditions to trigger but can lead to complete site compromise, including data theft and malware installation.
What an attacker can do
Run their own code on the site and take full control of it.
Potential impact on your site
Complete site compromise: attackers can steal data, modify content, install malware, or redirect visitors.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but attack complexity is high.
Key dates
External resources
Related vulnerabilities
