This vulnerability in magentech FlashMart arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion attacks. It affects FlashMart versions up to and including 2.0.15. Exploiting this flaw can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Successful exploitation can result in full compromise of the affected system's confidentiality, integrity, and availability. Attackers may execute arbitrary code or access sensitive files on the server running FlashMart. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.