Filename Control Vulnerability Affects Office Locator

CVE-2024-52501

Summary

A vulnerability related to the improper control of filenames used in include/require statements exists in the Office Locator plugin by Webbytemplate. This vulnerability allows attackers to exploit the PHP Remote File Inclusion (RFI) weakness, enabling them to include malicious files from remote servers. The issue affects all versions of Office Locator up to and including 1.3.0. Web application developers and administrators using this plugin should take immediate action to mitigate the risks associated with this vulnerability.

References