The vulnerability CVE-2024-50497 affects the wdesco Advanced Online Ordering and Delivery Platform through improper control of filenames in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, allowing attackers to include local files on the server. The affected versions include all versions up to and including 2.0.0. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected application and monitor for suspicious activity. Avoid exposing the vulnerable platform to untrusted networks. Do not rely on generic mitigations without vendor confirmation.