CVE-2024-49649
Published: 07 January 2025
Summary
CVE-2024-49649 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Buildapp Build App Online. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a PHP Local File Inclusion flaw, categorized under CWE-98 and CWE-829 as improper control of filenames in include/require statements. It affects the Build App Online WordPress plugin by hakeemnala, impacting all versions through 1.0.23. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack vectors with no required authentication or user interaction.
An unauthenticated attacker can supply crafted input to force the inclusion of arbitrary local files on the server. Successful exploitation grants full control over confidentiality, integrity, and availability, enabling reading of sensitive configuration or source files, potential code execution, or further compromise of the WordPress installation and underlying host.
The Patchstack advisory documents the flaw in the plugin and identifies the affected versions up to 1.0.23. The associated EPSS score remains low, with a current value of 0.0609 and a peak of 0.0641, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-43773
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Build App Online: from n/a through <= 1.0.23.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct LFI/RFI in public-facing WordPress plugin enables unauthenticated remote exploitation for RCE or sensitive data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper control of filenames in PHP include/require statements by requiring validation and sanitization of user-supplied inputs to prevent local file inclusion.
Mandates identification, reporting, and timely correction of the specific flaw in Build App Online plugin versions through <=1.0.23, eliminating the vulnerability via patching or removal.
Enforces least privilege for the web server process running the PHP application, restricting access to sensitive local files even if inclusion occurs.