Icecoder
Monthly
Path traversal in ICEcoder through version 8.1 enables authenticated low-privilege users to move arbitrary files from outside the web document root into web-accessible directories by injecting traversal sequences into the `oldFileName` parameter of rename and move operations. The flaw, located in `lib/file-control.php` around line 198, allows an attacker to expose sensitive server-side file contents via direct HTTP retrieval while simultaneously deleting the original - combining information disclosure with destructive write impact. No public exploit code or active exploitation has been confirmed at time of analysis, though the referenced Caycon advisory includes precise source code pointers that make reproduction straightforward.
OS command injection in ICEcoder through 8.1 allows authenticated low-privilege users to execute arbitrary operating system commands as the web-server user. The flaw resides in lib/properties.php (line 37), where a user-supplied filesystem directory path is passed without any shell metacharacter escaping into a popen() call. An attacker with ICEcoder login access can create a directory whose name embeds shell metacharacters, then invoke the Properties function to trigger command execution. No public exploit or CISA KEV listing is confirmed at time of analysis, but a detailed researcher advisory with source-code references is publicly available on GitHub.
Path traversal in ICEcoder through version 8.1 allows authenticated low-privilege attackers to read, write, or delete arbitrary files on the host filesystem by submitting traversal sequences or absolute paths to the file-control endpoint. The root cause is a PHP logic error in File::check() where the document-root confinement check compares the return value of realpath() against boolean true - a comparison that can never evaluate to true in PHP, since realpath() returns a string or false - rendering the entire path-restriction mechanism permanently inoperative. A detailed public advisory identifying the exact vulnerable code line is available via VulnCheck and GitHub; no patch version has been confirmed at time of analysis.
Unauthenticated remote code execution in ICEcoder 8.1 allows any network-reachable attacker to run arbitrary OS commands as the web-server user by exploiting a three-weakness chain in the terminal endpoint: an authentication bypass triggered by supplying a password parameter, a CSRF skip triggered by any non-empty csrf value, and unsanitized command passthrough directly into PHP's proc_open(). The attack requires a single crafted HTTP POST request and no prior credentials. A public proof-of-concept appears available via a GitHub Gist reference in the VulnCheck advisory. No active exploitation is confirmed by CISA KEV at the time of this analysis.
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ICEcoder v8.1 allows attackers to execute a directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal in ICEcoder through version 8.1 enables authenticated low-privilege users to move arbitrary files from outside the web document root into web-accessible directories by injecting traversal sequences into the `oldFileName` parameter of rename and move operations. The flaw, located in `lib/file-control.php` around line 198, allows an attacker to expose sensitive server-side file contents via direct HTTP retrieval while simultaneously deleting the original - combining information disclosure with destructive write impact. No public exploit code or active exploitation has been confirmed at time of analysis, though the referenced Caycon advisory includes precise source code pointers that make reproduction straightforward.
OS command injection in ICEcoder through 8.1 allows authenticated low-privilege users to execute arbitrary operating system commands as the web-server user. The flaw resides in lib/properties.php (line 37), where a user-supplied filesystem directory path is passed without any shell metacharacter escaping into a popen() call. An attacker with ICEcoder login access can create a directory whose name embeds shell metacharacters, then invoke the Properties function to trigger command execution. No public exploit or CISA KEV listing is confirmed at time of analysis, but a detailed researcher advisory with source-code references is publicly available on GitHub.
Path traversal in ICEcoder through version 8.1 allows authenticated low-privilege attackers to read, write, or delete arbitrary files on the host filesystem by submitting traversal sequences or absolute paths to the file-control endpoint. The root cause is a PHP logic error in File::check() where the document-root confinement check compares the return value of realpath() against boolean true - a comparison that can never evaluate to true in PHP, since realpath() returns a string or false - rendering the entire path-restriction mechanism permanently inoperative. A detailed public advisory identifying the exact vulnerable code line is available via VulnCheck and GitHub; no patch version has been confirmed at time of analysis.
Unauthenticated remote code execution in ICEcoder 8.1 allows any network-reachable attacker to run arbitrary OS commands as the web-server user by exploiting a three-weakness chain in the terminal endpoint: an authentication bypass triggered by supplying a password parameter, a CSRF skip triggered by any non-empty csrf value, and unsanitized command passthrough directly into PHP's proc_open(). The attack requires a single crafted HTTP POST request and no prior credentials. A public proof-of-concept appears available via a GitHub Gist reference in the VulnCheck advisory. No active exploitation is confirmed by CISA KEV at the time of this analysis.
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/terminal-xhr.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ICEcoder 8.1 is vulnerable to Cross Site Scripting (XSS) via lib/settings-screen.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ICEcoder 8.1 contains a Path Traversal vulnerability via lib/backup-versions-preview-loader.php. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
ICEcoder v8.1 allows attackers to execute a directory traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.