CVE-2024-49317 in Point Maker Plugin
Summary
by MITRE • 10/17/2024
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows PHP Local File Inclusion.This issue affects Point Maker: from n/a through <= 0.1.4.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/06/2026
The CVE-2024-49317 vulnerability represents a critical improper control of filename for include/require statement flaw in the ZIPANG Point Maker application, specifically targeting version 0.1.4 and earlier. This vulnerability falls under the category of PHP Remote File Inclusion (RFI) and Local File Inclusion (LFI) attacks, which are classified under CWE-88 and CWE-98 in the Common Weakness Enumeration catalog. The vulnerability stems from inadequate input validation and sanitization of user-supplied parameters that are directly used in PHP include or require statements without proper filtering mechanisms.
The technical implementation of this vulnerability occurs when the Point Maker application accepts user input through HTTP parameters and directly incorporates this input into file inclusion operations. Attackers can exploit this by manipulating URL parameters or POST data to reference arbitrary files on the server, potentially leading to unauthorized code execution or information disclosure. The vulnerability exists because the application fails to validate or sanitize the filename parameter before using it in the include/require statement, creating a direct path for malicious file inclusion attacks.
The operational impact of this vulnerability is severe as it allows attackers to execute arbitrary PHP code on the target server, potentially leading to complete system compromise. An attacker could leverage this vulnerability to include malicious PHP scripts from remote servers, enabling them to perform actions such as data exfiltration, privilege escalation, or establishing persistent backdoors. The vulnerability affects all versions of Point Maker up to and including 0.1.4, indicating a widespread exposure across multiple installations. This type of attack aligns with ATT&CK technique T1190 (Exploit Public-Facing Application) and T1059.007 (Command and Scripting Interpreter: PHP) in the MITRE ATT&CK framework, demonstrating how attackers can exploit web application vulnerabilities to gain unauthorized access to systems.
Mitigation strategies for this vulnerability include implementing strict input validation and sanitization of all user-supplied parameters before they are used in file inclusion operations. The application should enforce a whitelist approach for acceptable filenames, rejecting any input that contains suspicious characters or patterns. Additionally, developers should disable PHP's allow_url_include and allow_url_fopen directives in the php.ini configuration file to prevent remote file inclusion attacks. Regular security updates and patches should be applied to ensure that all known vulnerabilities are addressed, and proper access controls should be implemented to limit the exposure of vulnerable applications. The remediation process should also include thorough code reviews to identify and eliminate similar patterns throughout the application codebase, as this vulnerability represents a common security flaw that could exist in other parts of the software architecture.