CVE-2023-2453 Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘requireonce’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known...