CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign PenNews pennews allows PHP Local File Inclusion.This issue affects PenNews: from n/a through < 6.7.3.
Explanation of Vulnerability in Simple Terms
PenNews versions up to 6.7.3 contain a remote code execution vulnerability that allows an attacker to run arbitrary code on the site without authentication. The vulnerability requires specific conditions to exploit but can compromise the entire site if successful. Site administrators should update immediately to a version newer than 6.7.3.
What an attacker can do
Run their own code on the site and take full control of it.
Potential impact on your site
Complete site compromise, data theft, malware injection, and loss of availability.
Conditions required to exploit
Network access to the site; no authentication required, but exploitation requires specific conditions.
Key dates
External resources
Related vulnerabilities
