CVE-2023-33604

Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php

Critical · published June 7, 2023

CVSS v3.1
9.1
EPSS
1%
Percentile
56.1
In the wild
Unconfirmed
What it is

🔥 A crafted POST request is all it takes to delete any file on the server! This arbitrary file deletion vulnerability in Imperial CMS v7.5 is a game changer for attackers. ⚠️ Imagine a careless librarian who misplaces the procedure for removing books. With the wrong form, someone could erase your favorite novel from existence without anyone noticing! That's the risk posed by this vulnerability, where the DelspReFile function in /sp/ListSp.php can lead to devastating data loss. An attacker could exploit this flaw to wipe out crucial files, causing absolute chaos in your web application. Picture a data graveyard where important documents and images vanish at the click of a button—absolutely devastating! This vulnerability could leave your system vulnerable to operational downtime and loss of critical information.

Put simply

Imagine a careless librarian who misplaces the procedure for removing books. With the wrong form, someone could erase your favorite novel from existence without anyone noticing! That's the risk posed by this vulnerability, where the DelspReFile function in /sp/ListSp.php can lead to devastating data loss. This arbitrary file deletion vulnerability in Imperial CMS v7.5 allows attackers to remove files by sending a specially crafted POST request to the DelspReFile function in /sp/ListSp.php, bypassing any security checks that should be in place.

What to do

An attacker could exploit this flaw to wipe out crucial files, causing absolute chaos in your web application. Picture a data graveyard where important documents and images vanish at the click of a button—absolutely devastating! This vulnerability could leave your system vulnerable to operational downtime and loss of critical information. To protect your system, immediately update to the patched version of Imperial CMS. Ensure all file operations are carefully validated to prevent unauthorized deletions. Regularly audit your file permissions and server configurations to enhance security. You've got this! Follow these steps, and you'll fortify your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00800 · 56.1th percentile
Published
2023-06-07T00:00Z
EPSS history
Timeline
  • 07 JUN 00:00Z
    Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php
    cvelistv5