CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through <= 1.17.
Explanation of Vulnerability in Simple Terms
Soleil versions 1.17 and earlier contain a code injection vulnerability that allows unauthenticated attackers to run arbitrary code on the site. The vulnerability requires specific conditions to exploit but can lead to complete compromise of the site, including data theft and unauthorized modifications. Site administrators should update immediately to a version newer than 1.17.
What an attacker can do
Run arbitrary code on the site without authentication, potentially stealing data or modifying content.
Potential impact on your site
Complete site compromise possible, including data theft, malware injection, and loss of control over content.
Conditions required to exploit
Network access to the site; no authentication required, but exploitation requires specific technical conditions.
Key dates
External resources
Related vulnerabilities
