EUVD-2025-17481CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme CraftXtore allows PHP Local File Inclusion. This issue affects CraftXtore: from n/a through 1.7.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in BZOTheme CraftXtore versions up to 1.7 that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. The vulnerability has a CVSS score of 8.1 (high severity) with network accessibility and high impact to confidentiality, integrity, and availability. Exploitation requires moderate attack complexity but no user interaction or privileges, making it a significant risk if actively exploited or proof-of-concept code becomes public.
Technical ContextAI
This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP-specific vulnerability class where user-controlled input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. The root cause is the absence of input validation and sanitization on filename parameters before they are used in file inclusion operations. In the context of BZOTheme CraftXtore (a WordPress theme framework), the vulnerability likely exists in template loading, configuration file inclusion, or plugin loader mechanisms where user input or HTTP parameters are directly concatenated into file paths. While initially described as 'Remote File Inclusion' (RFI), the CVE description clarifies this is actually 'Local File Inclusion' (LFI), meaning attackers can access files already present on the server (e.g., /etc/passwd, application source code, configuration files containing credentials) rather than including files from remote servers. CPE identification would typically target: cpe:2.3:a:bzotheme:craftxtore:*:*:*:*:*:*:*:* (versions through 1.7).
RemediationAI
- IMMEDIATE: Identify all WordPress installations using BZOTheme CraftXtore and determine current version via wp-admin or theme metadata. 2. PATCH: Upgrade to the latest version of CraftXtore released after this CVE disclosure (vendor should release version 1.8 or higher with validation controls; specific patch version not provided in available data—check BZOTheme release notes and WordPress.org theme directory). 3. WORKAROUND (temporary, if patching is delayed): Implement a Web Application Firewall (WAF) rule blocking common LFI patterns (e.g., requests containing '../', 'php://', 'file://', or attempts to access sensitive paths like /etc/passwd or wp-config.php). 4. CODE-LEVEL MITIGATION: Review any custom theme modifications that handle file inclusion. Implement strict input validation: whitelist allowed filenames/paths, use basename() to strip directory traversal, validate against a list of permitted files, and avoid passing user input directly to include/require. 5. MONITORING: Enable access logging and search for suspicious path traversal sequences in theme-related requests to detect exploitation attempts. 6. DISABLE THEME (if unpatched and high-risk): Temporarily switch to a well-maintained alternative theme while patching is prepared.
Share
External POC / Exploit Code
Leaving vuln.today