CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alexander AnyComment anycomment allows PHP Local File Inclusion.This issue affects AnyComment: from n/a through <= 0.3.6.
Explanation of Vulnerability in Simple Terms
AnyComment versions 0.3.6 and earlier contain a code injection vulnerability that allows attackers to execute arbitrary code on affected sites. The vulnerability requires user interaction—typically a victim must click a malicious link or visit a crafted page. An attacker with no prior authentication can exploit this to read sensitive data, modify site content, or disrupt service.
What an attacker can do
Execute arbitrary code on the site, read sensitive data, modify content, or cause service disruption.
Potential impact on your site
An attacker can run malicious code on your site without needing a user account, potentially compromising your entire installation.
Conditions required to exploit
No authentication required, but the victim must click a link or visit a page controlled by the attacker.
Key dates
External resources
