CyberRota Analysis
AI-GeneratedICEcoder versions up to 8.1 are vulnerable due to improper handling of filesystem paths in the properties.php file, allowing authenticated users to inject OS commands through specially crafted directory names. This flaw enables attackers to execute arbitrary commands on the server with the privileges of the web-server user, posing a significant risk to system integrity. Organizations using ICEcoder should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute arbitrary commands as the web-server user via popen().