EUVD-2025-18649CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara allows PHP Local File Inclusion. This issue affects Hara: from n/a through 1.2.10.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in thembay Hara that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. Affected versions range from an unspecified baseline through version 1.2.10. While the CVSS score of 8.1 is elevated, the attack complexity is rated 'High,' suggesting real-world exploitation requires specific environmental conditions or timing.
Technical ContextAI
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP code inclusion flaw where user-supplied input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. thembay Hara, a PHP-based application/theme, fails to properly validate or sanitize filename parameters before passing them to file inclusion functions. This differs from Remote File Inclusion (RFI) by restricting exploitation to files already present on the server filesystem, though the attacker can still achieve arbitrary code execution by including files such as web server logs, uploaded files, or PHP wrappers (e.g., php://filter). The vulnerability affects thembay Hara versions up to and including 1.2.10; the lack of a specified 'from' version suggests the flaw may have existed since early releases.
Share
External POC / Exploit Code
Leaving vuln.today