PHP Remote File Inclusion Vulnerability in Shopready

CVE-2024-52497

Summary

The vulnerability arises from improper control over filenames used in include or require statements within the Shopready application developed by Quomodosoft. This weakness permits remote attackers to conduct PHP Local File Inclusion (LFI) attacks, potentially leading to unauthorized access to sensitive files on the server. Affected versions include Shopready from n/a through 3.5, highlighting the need for immediate attention to security practices concerning file handling in PHP applications, particularly in web-based environments.

References