PT-2025-5505 · Unknown · Morkva Ua Shipping

Dimas Maulana · Published 2025-01-27 · Updated 2025-02-01 · CVE-2025-24685

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Morkva UA Shipping versions 1.0.0 through 1.0.18

Description The issue is a Path Traversal vulnerability that allows PHP Local File Inclusion. This means an attacker could potentially access and include local files on the server, which could lead to sensitive information disclosure or code execution.

Recommendations For versions 1.0.0 through 1.0.18, update to a version later than 1.0.18 to resolve the issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation. Avoid using vulnerable functions or parameters that could be used for PHP Local File Inclusion until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Weakness Enumeration

CWE-35

Related Identifiers

CVE-2025-24685

Affected Products

Morkva Ua Shipping

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-24685 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/BursaMatus/status/1883934523546595738 · Twitter Post
• https://twitter.com/BursaMatus/status/1883933747038343445 · Twitter Post
• https://twitter.com/CVEnew/status/1883881064684191994 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/cracbot/status/1885587744811790846 · Twitter Post
• https://t.me/cvedetector/16454 · Telegram Post