PT-2023-10832 · Unknown+1 · Online Accounting System+1

Pich4Ya · Published 2023-12-03 · Updated 2024-05-17 · CVE-2018-25094

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ระบบบัญชีออนไลน์ Online Accounting System versions up to 1.4.0

Description A problematic issue affects the processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 1.4.0, upgrade to version 2.0.0 to address this issue. As a temporary workaround, consider restricting access to the vulnerable file ckeditor/filemanager/browser/default/image.php until the upgrade is applied. Avoid using the argument fid with potentially malicious input in the affected file.

Fix

Path traversal

Weakness Enumeration

CWE-24

CWE-22

Related Identifiers

CVE-2018-25094

Affected Products

Ckeditor

Online Accounting System

References · 7

• https://osv.dev/vulnerability/CVE-2018-25094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25094 · Security Note
• https://github.com/59160781/project/commit/9d9618422b980335bb30be612ea90f4f56cb992c · Patch
• https://t.me/cvenotify/62004 · Telegram Post
• https://vuldb.com/?id.246641 · Note
• https://t.me/cvenotify/62646 · Telegram Post
• https://vuldb.com/?ctiid.246641 · Note