CVE-2024-47946

Description

If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as "www-data".

Reserved 2024-10-07 | Published 2024-12-10 | Updated 2024-12-20 | Assigner SEC-VLab

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

Product status

Default status
affected

Any version before 7.42
affected

Credits

Daniel Hirschberger (SEC Consult Vulnerability Lab) finder

Tobias Niemann (SEC Consult Vulnerability Lab) finder

References

r.sec-consult.com/imageaccess third-party-advisory

www.imageaccess.de/?page=SupportPortal&lang=en patch

cve.org (CVE-2024-47946)

nvd.nist.gov (CVE-2024-47946)

Download JSON