CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes EcoGrow ecogrow allows PHP Local File Inclusion.This issue affects EcoGrow: from n/a through <= 1.7.
Explanation of Vulnerability in Simple Terms
EcoGrow versions 1.7 and earlier contain a remote code execution vulnerability. An attacker on the network can exploit this without authentication or user interaction to execute arbitrary code, read sensitive data, or disrupt the site. The attack requires specific conditions to succeed. Update immediately to a version newer than 1.7.
What an attacker can do
Execute code on the site, read sensitive files, or cause the site to become unavailable.
Potential impact on your site
Complete compromise of the site, including data theft, malware injection, and service disruption.
Conditions required to exploit
Network access; no authentication required. Specific conditions must be met to exploit.
Key dates
External resources
Related vulnerabilities
