CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Domnoo domnoo allows PHP Local File Inclusion.This issue affects Domnoo: from n/a through <= 1.49.
Explanation of Vulnerability in Simple Terms
Domnoo versions up to 1.49 contain a remote code execution vulnerability accessible over the network without authentication. An attacker can exploit this flaw to run arbitrary code on the affected server, potentially compromising the entire site. The attack requires specific conditions to be met but does not require user interaction or valid credentials.
What an attacker can do
Run their own code on the server to compromise the site, steal data, or modify content.
Potential impact on your site
Complete site compromise possible; attacker can read/modify all data and take full control of the server.
Conditions required to exploit
Network access to the vulnerable Domnoo installation; no authentication required.
Key dates
External resources
Related vulnerabilities
