PT-2024-33457 · Unknown+1 · Zipang Point Maker+1

Theviper17 · Published 2024-10-17 · Updated 2024-10-18 · CVE-2024-49317

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZIPANG Point Maker versions through 0.1.4

Description The issue affects ZIPANG Point Maker due to improper control of filename for include/require statement in PHP program, allowing PHP Local File Inclusion. This is related to 'PHP Remote File Inclusion.' It lets attackers perform PHP Local File Inclusion.

Recommendations For versions through 0.1.4, update to a version that fixes the 'PHP Remote File Inclusion' vulnerability to prevent PHP Local File Inclusion attacks. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-49317

Affected Products

Php

Zipang Point Maker

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-49317 · Security Note
• https://t.me/cvedetector/8208 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1847092770344743188 · Twitter Post
• https://patchstack.com/database/vulnerability/point-maker/wordpress-point-maker-plugin-0-1-4-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Plugin/point-maker/vulnerability/wordpress-point-maker-plugin-0-1-4-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1846967463461761509 · Twitter Post