The vulnerability identified as CVE-2024-49317 affects ZIPANG Point Maker (up to version 0.1.4) and involves improper control of filenames in PHP include/require statements. This results in a PHP Local File Inclusion vulnerability, where an attacker can manipulate the filename parameter to include local files on the server. The vulnerability does not have an associated CVSS score or known exploits in the wild, and no official patch or remediation guidance has been provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files from the server or execute arbitrary PHP code if the included files contain executable code. This can lead to information disclosure or further compromise of the affected system. However, no known exploits have been reported, and the extent of impact depends on the server configuration and the files accessible via inclusion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to vulnerable versions of ZIPANG Point Maker and applying general PHP security best practices to limit file inclusion risks. Avoid exposing the application to untrusted input that controls include/require filenames.