PT-2025-4476 · Service Shogun · Ach Invoice App

Tahu.Datar · Published 2025-01-07 · Updated 2025-01-07 · CVE-2025-22364

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ach Invoice App versions 1.0.1 and earlier

Description The issue is related to improper control of filenames for Include/Require statements in PHP, allowing PHP Local File Inclusion. This problem affects the Service Shogun Ach Invoice App, enabling the inclusion of local PHP files.

Recommendations For versions 1.0.1 and earlier, update to a version that fixes the improper control of filenames for Include/Require statements to prevent PHP Local File Inclusion. As a temporary workaround, consider restricting access to vulnerable include/require statements until a patch is available.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-22364

Affected Products

Ach Invoice App

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-22364 · Security Note
• https://twitter.com/CVEnew/status/1876587733210067356 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/ach-invoice-app/vulnerability/wordpress-ach-invoice-app-plugin-1-0-1-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/14512 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1876616243144212840 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/ach-invoice-app/vulnerability/wordpress-ach-invoice-app-plugin-1-0-1-local-file-inclusion-vulnerability?_s_id=cve · Note