Attackers Can Execute Arbitrary Code on Linux Devices via Valid PNG Files
CVE-2024-47946

7.2HIGH

Key Information:

Vendor

Image Access Gmbh

Status
Scan2net
Vendor
CVE Published:
10 December 2024

Badges

👾 Exploit Exists

What is CVE-2024-47946?

A vulnerability in Image Access software allows an attacker with a valid Poweruser session to execute arbitrary PHP code and operating system commands. By uploading specially crafted PNG files containing injected PHP scripts as desktop backgrounds or lock screens, the attacker can access this code via the web root once the file is accessed. This flaw poses significant security risks as the executed code runs with the privileges of the web server user, leading to potential compromise of the affected system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Scan2Net 0

References

https://r.sec-consult.com/imageaccess
third-party-advisory
https://www.imageaccess.de/?page=SupportPortal&lang=en
patch

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Hirschberger (SEC Consult Vulnerability Lab)
Tobias Niemann (SEC Consult Vulnerability Lab)
JSON
.