CVE-2023-27179

HIGHNuclei

GDidees CMS 3.9.1 - Local File Disclosure

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-27179 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 11, 2025 · Source: CVE List

Proofs of concept

1

Catalogued exploits

ExploitDBGDidees CMS 3.9.1 - Local File DisclosureExploitDB exploitby Hadi MeneNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHGDidees CMS v3.9.1 - Arbitrary File DownloadCVSS 7.5

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.

Impact

An attacker can exploit this vulnerability to download arbitrary files from the server.

Remediation

Apply the latest patch or upgrade to a newer version of GDidees CMS.

WeaknessesCWE-434
Authorstheamanrawat
Template tagscve2023cvepacketstormfile-downloadgdideeslfrvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:gdidees:gdidees_cms:*:*:*:*:*:*:*:*
https://www.gdidees.eu/cms-1-0.html https://gist.github.com/Hadi999/516aa25b953b0cba57089a0c11b1305b https://nvd.nist.gov/vuln/detail/CVE-2023-27179 http://packetstormsecurity.com/files/171894/GDidees-CMS-3.9.1-Local-File-Disclosure-Directory-Traversal.html https://knowledge-base.secureflag.com/vulnerabilities/unrestricted_file_download/unrestricted_file_download_vulnerability.html

Source: ProjectDiscovery

References

6