CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Consulting consulting allows PHP Local File Inclusion.This issue affects Consulting: from n/a through < 6.7.5.
Explanation of Vulnerability in Simple Terms
A remote code execution vulnerability exists in StylemixThemes Consulting versions up to 6.7.5. An authenticated attacker with low privileges can execute arbitrary PHP code on the site without user interaction. The vulnerability stems from improper input validation in a code execution pathway. All users should update immediately to a patched version.
What an attacker can do
Run their own PHP code on the site and take full control of it.
Potential impact on your site
Any registered user can compromise your entire site, steal data, or inject malware.
Conditions required to exploit
Attacker must have a low-privilege account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
