EUVD-2023-29882
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in choicehomemortgage AI Mortgage Calculator allows PHP Local File Inclusion. This issue affects AI Mortgage Calculator: from n/a through 1.0.1.
Analysis
PHP Local File Inclusion (LFI) vulnerability in choicehomemortgage AI Mortgage Calculator versions up to 1.0.1, caused by improper input validation on file inclusion statements. An authenticated attacker with low privileges can exploit this vulnerability over the network to read arbitrary files from the server, potentially leading to information disclosure, privilege escalation, or remote code execution. The high CVSS score of 7.5 reflects the severity of potential impacts (confidentiality, integrity, availability compromise), though the requirement for authenticated access and high attack complexity somewhat limit real-world exploitability.
Technical Context
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-controlled input is passed directly to include(), require(), include_once(), or require_once() functions without proper validation or sanitization. The AI Mortgage Calculator plugin fails to adequately filter or whitelist filenames before including them, allowing attackers to traverse the filesystem and include arbitrary local files (LFI, not RFI despite the description mentioning RFI). In PHP environments, this can lead to disclosure of sensitive files (configuration files containing database credentials, /etc/passwd on Linux systems, application source code) or, in specific conditions with log poisoning or file upload chains, potential code execution. The affected product is choicehomemortgage AI Mortgage Calculator (CPE context suggests WordPress plugin distribution), versions from unspecified baseline through 1.0.1.
Affected Products
AI Mortgage Calculator (1.0.1 and earlier (baseline version not specified))
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today