EUVD-2025-28288CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Sapa allows PHP Local File Inclusion. This issue affects Sapa: from n/a through 1.1.14.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in thembay Sapa that allows unauthenticated remote attackers to include and execute arbitrary PHP files through improper input validation on filename parameters in include/require statements. Affected versions range from an unspecified baseline through version 1.1.14. With a CVSS score of 8.1 and network-accessible attack vector, this vulnerability enables confidentiality, integrity, and availability compromise, though exploitation requires high attack complexity (AC:H) suggesting non-trivial preconditions.
Technical ContextAI
The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of defects where PHP applications fail to properly sanitize or validate user-supplied input before passing it to include(), require(), include_once(), or require_once() functions. The thembay Sapa product (a PHP-based application, likely a WordPress theme or plugin given the vendor naming convention) does not adequately filter or whitelist filenames, allowing attackers to traverse directory structures or reference remote URLs (if allow_url_include is enabled) to load malicious PHP code. The LFI designation indicates local file inclusion rather than remote file inclusion, meaning the attack leverages files already present on the target server or accessible through directory traversal sequences (../ payloads) rather than remote URLs, though RFI is also possible depending on PHP configuration.
RemediationAI
Immediate Actions:
- Upgrade thembay Sapa to a patched version beyond 1.1.14 as soon as available from the vendor.
- If patched version is unavailable, disable the Sapa plugin/theme or restrict access to affected pages via .htaccess or WAF rules.
- Apply input validation: ensure all user-supplied parameters passed to include/require are validated against a whitelist of allowed filenames; reject any input containing directory traversal sequences (../, .., %, null bytes) or remote URLs.
- Disable PHP's allow_url_include directive (set to Off in php.ini) to mitigate remote file inclusion variants.
- Monitor web server logs for suspicious include/require patterns (e.g., LFI payloads like /etc/passwd, /var/www/html/wp-config.php, or repeated ../ sequences).
- Apply principle of least privilege: run PHP-FPM/Apache under a dedicated unprivileged user account to limit file access.
Vendor Patch: Check thembay's official website, GitHub repository, or WordPress plugin repository for version 1.1.15 or later.
Share
External POC / Exploit Code
Leaving vuln.today