CVE-2024-50497

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') (CWE-98)

Published: Oct 28, 2024 / Updated: 22d ago

010
CVSS 9.8EPSS 0.04%Critical
CVE info copied to clipboard

Summary

An Improper Control of Filename for Include/Require Statement vulnerability, specifically a PHP Remote File Inclusion issue, has been identified in the BuyNowDepot Advanced Online Ordering and Delivery Platform. This vulnerability allows for PHP Local File Inclusion. The affected versions of the Advanced Online Ordering and Delivery Platform range from an unspecified starting point up to and including version 2.0.0.

Impact

This vulnerability has a critical severity with a CVSS v3.1 base score of 9.8. The impact on confidentiality, integrity, and availability is rated as HIGH. The attack vector is NETWORK-based, requiring no user interaction or privileges, and the attack complexity is considered LOW. Successful exploitation could lead to unauthorized access to sensitive files, potential execution of malicious code, and compromise of the affected system's confidentiality, integrity, and availability. This could result in data theft, system manipulation, or service disruptions.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

As of the vulnerability publication date (October 28, 2024), there is no specific information provided about an available patch. The vulnerability affects the Advanced Online Ordering and Delivery Platform up to version 2.0.0, suggesting that a newer version addressing this issue may be released or pending.

Mitigation

While awaiting an official patch, consider the following mitigation strategies: 1. Upgrade the Advanced Online Ordering and Delivery Platform to a version newer than 2.0.0 if available. 2. Implement strict input validation and sanitization for all user-supplied input, especially those used in file inclusion statements. 3. Use whitelisting techniques to restrict the files that can be included. 4. Employ web application firewalls (WAF) to detect and block potential file inclusion attempts. 5. Apply the principle of least privilege to PHP processes and file system permissions. 6. Monitor system logs for any suspicious file inclusion attempts. 7. Consider disabling remote file inclusion if not strictly necessary for the application's functionality.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-50497

Oct 28, 2024 at 1:15 PM
CVSS

A CVSS base score of 8.1 has been assigned.

Oct 28, 2024 at 1:20 PM / nvd
First Article

Feedly found the first article mentioning CVE-2024-50497. See article

Oct 28, 2024 at 1:22 PM / CVE
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Oct 28, 2024 at 1:23 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 9.9%)

Oct 29, 2024 at 9:43 AM
CVSS

A CVSS base score of 9.8 has been assigned.

Oct 31, 2024 at 2:00 PM / nvd
Static CVE Timeline Graph

Affected Systems

Buynowdepot/advanced_online_ordering_and_delivery_platform
+null more

Links to Mitre Att&cks

T1055: Process Injection
+null more

Attack Patterns

CAPEC-193: PHP Remote File Inclusion
+null more

News

Update Tue Nov 5 14:31:28 UTC 2024
Update Tue Nov 5 14:31:28 UTC 2024
US-CERT Vulnerability Summary for the Week of October 28, 2024
The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available.
Vulnerability Summary for the Week of October 28, 2024
High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info acnoo -- flutter_api Authentication Bypass Using an Alternate Path or Channel vulnerability in Acnoo Acnoo Flutter API allows Authentication Bypass.This issue affects Acnoo Flutter API: from n/a through 1.0.5. 2024-10-28 9.8 CVE-2024-50486 audit@patchstack.com adirectory--aDirectory Unrestricted Upload of File with Dangerous Type vulnerability in adirectory aDirectory allows Upload a Web Shell to a Web Server.This issue affects aDirectory: from n/a through 1.3. 2024-10-29 10 CVE-2024-50420 audit@patchstack.com Ajar Productions--Ajar in5 Embed Unrestricted Upload of File with Dangerous Type vulnerability in Ajar Productions Ajar in5 Embed allows Upload a Web Shell to a Web Server.This issue affects Ajar in5 Embed: from n/a through 3.1.3. 2024-10-29 10 CVE-2024-50473 audit@patchstack.com Amin Omer--Sudan Payment Gateway for WooCommerce Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through 1.2.2. 2024-10-29 10 CVE-2024-50494 audit@patchstack.com amu02aftab--Enable Shortcodes inside Widgets,Comments and Experts The The Enable Shortcodes inside Widgets,Comments and Experts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode.
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 21, 2024 to October 27, 2024)
The team rolled out enhanced protection via firewall rules for the following vulnerabilities in real-time to our Premium, Care, and Response customers last week: WordPress Plugins with Reported Vulnerabilities Last Week
Security Bulletin 30 Oct 2024 - Cyber Security Agency of Singapore
A vulnerability in the SSH subsystem of Cisco Adaptive Security Appliance (ASA) Software could allow an authenticated, remote attacker to execute ...
See 9 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI