PT-2024-35224 · Radiustheme · Classified Listing

João Pedro S Alcântara · Published 2024-11-16 · Updated 2024-11-18 · CVE-2024-52386

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Classified Listing versions through 3.1.15.1

Description The issue is related to Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability, which allows PHP Local File Inclusion. This vulnerability affects the Classified Listing plugin by RadiusTheme, part of the Business Directory Team.

Recommendations For versions through 3.1.15.1, update to a version later than 3.1.15.1 to resolve the issue. As a temporary workaround, consider restricting access to vulnerable PHP files to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2024-52386

Affected Products

Classified Listing

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-52386 · Security Note
• https://t.me/cvedetector/11249 · Telegram Post
• https://patchstack.com/database/vulnerability/classified-listing/wordpress-classified-listing-plugin-3-1-15-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://t.me/cvenotify/101915 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1857945280487796874 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/classified-listing/vulnerability/wordpress-classified-listing-plugin-3-1-15-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/1857901067201102328 · Twitter Post