PT-2023-32872 · Unknown · Icret Easyimages

Glzjin · Published 2023-12-24 · Updated 2024-08-02 · CVE-2023-7098

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions icret EasyImages version 2.8.3

Description A problematic vulnerability was found in icret EasyImages, affecting unknown code of the file app/hide.php. The manipulation of the key argument leads to path traversal, allowing an attacker to access files outside the intended directory, such as '../filedir'. The attack can be initiated remotely, but the complexity of the attack is rather high, making exploitation difficult. The exploit has been disclosed to the public and may be used. This issue only affects products that are no longer supported by the maintainer.

Recommendations For icret EasyImages version 2.8.3, as a temporary workaround, consider restricting access to the app/hide.php file until a patch is available. However, since this product is no longer supported by the maintainer, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2023-7098

Affected Products

Icret Easyimages

References · 8

• 🔥 https://note.zhaoj.in/share/MHnV2WLY9rxU · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7098 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7098 · Vendor Advisory
• https://t.me/cvenotify/65071 · Telegram Post
• https://vuldb.com/?ctiid.248950 · Note
• https://vuldb.com/?id.248950 · Note
• https://twitter.com/CVEnew/status/1739112530948362426 · Twitter Post
• https://t.me/cvenotify/88494 · Telegram Post