The vulnerability CVE-2024-44023 affects abcapp ABCApp Creator versions up to 1.1.2 and is characterized by improper validation or control of filenames used in PHP include or require statements. This flaw enables remote file inclusion, where an attacker can supply a malicious filename that causes the application to load and execute remote code. The CVSS 3.1 base score of 8.1 reflects a network attack vector with high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was published on October 5, 2024, and no patch or mitigation details have been provided by the vendor or other authoritative sources.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code on the affected system, potentially leading to full compromise of the application and underlying server. The impact includes complete loss of confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable application, applying web application firewall (WAF) rules to block suspicious requests targeting include/require parameters, and reviewing application configurations to limit remote file inclusion risks. Avoid exposing the application to untrusted networks if possible.