EUVD-2025-28291CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza allows PHP Local File Inclusion. This issue affects Diza: from n/a through 1.3.8.
AnalysisAI
PHP Local/Remote File Inclusion (LFI/RFI) vulnerability in thembay Diza affecting versions through 1.3.8, stemming from improper control of filenames in include/require statements (CWE-98). An unauthenticated network attacker can exploit this with high complexity to achieve arbitrary file inclusion, leading to information disclosure, code execution, or system compromise. The high CVSS score of 8.1 reflects the severity of potential impacts (confidentiality, integrity, and availability), though real-world exploitability depends on PHP configuration and the specific include/require patterns in affected code.
Technical ContextAI
This vulnerability exploits inadequate input validation on file paths passed to PHP's include(), require(), include_once(), or require_once() functions—core language constructs used for dynamic file loading. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) identifies the root cause: the application fails to sanitize or whitelist user-supplied input before using it in file inclusion statements. The vulnerability can manifest as Local File Inclusion (LFI)—reading arbitrary local files like /etc/passwd or configuration files—or Remote File Inclusion (RFI)—if allow_url_include is enabled in php.ini, allowing inclusion of attacker-controlled remote PHP files for code execution. thembay Diza is a WordPress theme/plugin ecosystem product; the specific affected CPE would be cpe:2.3:a:thembay:diza:*:*:*:*:*:*:*:* with versions ≤1.3.8. The vulnerability likely resides in template loading, asset inclusion, or theme customization routines that construct file paths from user input (GET/POST parameters, cookies, or headers) without proper validation.
RemediationAI
patch_availability: Upgrade thembay Diza to version 1.3.9 or later (specific patch version should be confirmed via thembay official release notes/security advisory); immediate_steps: ['Identify all WordPress installations using thembay Diza ≤1.3.8 via dashboard plugins/themes page or server file audit', 'Apply available security update to version 1.3.9+ immediately', 'If patch is unavailable, disable the affected plugin/theme and switch to an alternative until patched']; workarounds: ['Implement Web Application Firewall (WAF) rules to block suspicious file inclusion attempts (pattern matching for ../, etc.)', 'Restrict HTTP methods and input parameters that feed into include/require statements', "Ensure allow_url_include and allow_url_fopen are set to 'Off' in php.ini to mitigate RFI", "Monitor PHP error logs for 'Failed opening required' messages indicating exploitation attempts", 'Apply principle of least privilege to file system permissions on WordPress directories']; vendor_advisory: Contact thembay directly or monitor https://github.com/thembay/diza or official support channels for patch release; confirm advisory URL from official sources
Share
External POC / Exploit Code
Leaving vuln.today