CVE-2023-42286

The vulnerability (CWE-434) results from insufficient validation of files included through the template configuration mechanism. An attacker can prepare a malicious payload containing a path to a PHP file or other resource controlled by them. After processing such a payload by the application, the server executes the code or system commands contained in it. Due to the network vector without authentication requirements (AV:N/PR:N/UI:N), the attack can be conducted remotely by any person.

An attacker can execute arbitrary code or system commands on the server, leading to complete system takeover, data theft, modification of website content, and potential use of the server as a launching point for further attacks.

Apply patches available from the vendor according to references. It is also recommended to restrict access to the administration panel and template configuration module exclusively to trusted IP addresses.

EyouCMS version v1.6.4