EUVD-2025-18532CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa allows PHP Local File Inclusion. This issue affects Besa: from n/a through 2.3.8.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in thembay Besa versions through 2.3.8, stemming from improper control of filenames in include/require statements (CWE-98). An unauthenticated remote attacker can exploit this via a network vector with high complexity to achieve arbitrary file read/write capabilities, potentially leading to remote code execution. The high CVSS score of 8.1 reflects the severity of the confidentiality, integrity, and availability impact, though real-world exploitation requires specific conditions given the AC:H rating.
Technical ContextAI
This vulnerability exploits a weakness in PHP's file inclusion mechanisms where user-supplied input is not properly validated before being passed to include(), require(), include_once(), or require_once() statements. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP) is a well-documented class of vulnerabilities where an attacker manipulates the filename parameter to include arbitrary files from the local filesystem or, in some configurations, remote resources. The thembay Besa product, affected from inception through version 2.3.8, appears to use dynamic file inclusion without proper sanitization or allowlisting. Attack vectors typically involve manipulating GET/POST parameters, HTTP headers, or cookie values that feed into include statements. The high complexity rating (AC:H) suggests exploitation requires specific conditions: unusual server configurations (e.g., allow_url_include enabled), specific PHP wrappers (php://filter, php://input), or file upload capabilities to place exploit payloads.
RemediationAI
Immediate actions: (1) Upgrade thembay Besa to version 2.3.9 or later once available (check thembay's official release channels and security advisories). (2) If immediate patching is impossible, implement input validation: whitelist allowed filenames/paths, reject path traversal sequences (.., /, \), and use basename() to strip directory components. (3) Disable dangerous PHP settings: set allow_url_include=Off and allow_url_fopen=Off in php.ini. (4) Disable PHP wrappers if not required: wrap file inclusion calls with is_file() and realpath() checks to ensure included files exist within an expected directory. (5) Use PHP's open_basedir directive to restrict inclusion to a specific directory tree. (6) Implement Web Application Firewall (WAF) rules to detect and block LFI payloads (e.g., patterns containing ../, etc/passwd, php://). (7) Monitor server logs for suspicious include/require patterns and file access anomalies. For vendor: thembay should publish a security advisory with patched version information (expected: 2.3.9+) and recommend users upgrade. Long-term: adopt code review practices to identify all dynamic file inclusion and apply CWE-98 hardening patterns.
Share
External POC / Exploit Code
Leaving vuln.today