CVE-2024-31818

The vulnerability exists in the kiosk.php component of the DerbyNet application. The 'page' parameter passed to this script is not properly validated or filtered, allowing an attacker to provide a crafted path containing path traversal sequences (e.g., '../'). By manipulating this parameter, a remote attacker can exit the allowed application directory and execute arbitrary code on the server without requiring any privileges.

An attacker can gain full control over the server, including reading, modifying or deleting any files, as well as executing malicious code leading to system compromise. The confidentiality, integrity and availability of the entire server environment are at risk.

Apply patches available from the vendor according to the references. As a temporary workaround, it is recommended to restrict access to the kiosk.php component at the firewall or web server level and monitor the 'page' parameter for suspicious values.

DerbyNet version 9.0 — website/kiosk.php component