high7.5Public exploit code
CVE-2023-27179
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- GDidees CMS 3.9.1 - Local File Disclosure2023-04-20 · webapps · php
Impact
GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gdidees | Gdidees Cms | through 3.9.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/171894/GDidees-CMS-3.9.1-Local-File-Disclosure-Directory-Traversal.html
- https://gist.github.com/Hadi999/516aa25b953b0cba57089a0c11b1305b
- https://knowledge-base.secureflag.com/vulnerabilities/unrestricted_file_download/unrestricted_file_download_vulnerability.html
- https://www.gdidees.eu/cms-1-0.html
- http://packetstormsecurity.com/files/171894/GDidees-CMS-3.9.1-Local-File-Disclosure-Directory-Traversal.html
- https://gist.github.com/Hadi999/516aa25b953b0cba57089a0c11b1305b
- https://knowledge-base.secureflag.com/vulnerabilities/unrestricted_file_download/unrestricted_file_download_vulnerability.html
- https://www.gdidees.eu/cms-1-0.html
- https://packetstorm.news/files/id/171894