EUVD-2025-17484
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme GiftXtore allows PHP Local File Inclusion. This issue affects GiftXtore: from n/a through 1.7.4.
Analysis
PHP Local File Inclusion (LFI) vulnerability in BZOTheme GiftXtore versions through 1.7.4 that allows unauthenticated remote attackers to include and execute arbitrary local files on the server. This is a high-severity vulnerability (CVSS 8.1) that can lead to complete system compromise including confidentiality, integrity, and availability breaches. The vulnerability stems from improper validation of filename parameters in PHP include/require statements, enabling attackers to access sensitive files or execute malicious code without authentication.
Technical Context
This vulnerability exploits CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic server-side code injection flaw. The affected product BZOTheme GiftXtore (CPE likely: cpe:2.3:a:bzotheme:giftxtore:*:*:*:*:*:*:*:*) improperly handles user-supplied input when constructing file paths for PHP include() or require() functions. Rather than Remote File Inclusion (RFI), this specific instance is Local File Inclusion (LFI), meaning attackers can only access files already present on the server filesystem. However, LFI can be escalated to RCE through log file poisoning, session file manipulation, or by including PHP wrappers (data://, php://filter) depending on PHP configuration. The vulnerability likely exists in a template engine, theme loader, or module inclusion mechanism within the GiftXtore e-commerce platform.
Affected Products
GiftXtore (1.7.4 and all prior versions)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today