Remote Privilege Escalation in Thecosy IceCMS by Exploiting Id and Key Parameters
CVE-2023-40833

9.8CRITICAL

Key Information:

Vendor

Thecosy

Status
Icecms
Vendor
CVE Published:
12 October 2023

What is CVE-2023-40833?

A vulnerability in Thecosy IceCMS version 1.0.0 enables remote attackers to escalate their privileges. By manipulating the Id and key parameters in the getCosSetting function, an attacker can gain unauthorized access, potentially compromising sensitive information and performing actions beyond their intended privileges.

References

https://gist.github.com/Sholway/93f05987dbf35c15c26de32b1...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.