CVE-2023-54335

The vulnerability results from insufficient user identity verification during the login process (CWE-306 — missing authentication for critical function). An attacker can manipulate a login request in such a way as to bypass the password verification mechanism and gain access to the file management panel without knowing any authentication credentials. After gaining access, it is possible to upload a malicious PHP file to the system and then execute it remotely, resulting in full RCE on the server.

An attacker gains unauthorized access to the file management system and can subsequently take full control of the server by executing arbitrary system commands (RCE). The vulnerability allows complete server takeover, data theft, file modification, and potential use of the system as a launching point for further attacks.

Apply patches available from the vendor according to the references. It is recommended to restrict access to the eXtplorer interface exclusively to trusted IP addresses using a firewall or web server rules until updates are applied. If no patch is available, consider disabling or removing the application from the production environment.

eXtplorer version 2.1.14