CVE-2024-47946

{"id": "CVE-2024-47946", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-12-10T08:15:19.210", "references": [{"url": "https://r.sec-consult.com/imageaccess", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "https://www.imageaccess.de/?page=SupportPortal&lang=en", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "If the attacker has access to a valid Poweruser session, remote code execution is possible because specially crafted valid PNG files with injected PHP content can be uploaded as desktop backgrounds or lock screens. After the upload, the PHP script is available in the web root. The PHP code executes once the uploaded file is accessed. This allows the execution of arbitrary PHP code and OS commands on the device as \"www-data\"."}, {"lang": "es", "value": "Si el atacante tiene acceso a una sesi\u00f3n v\u00e1lida de usuario avanzado, es posible la ejecuci\u00f3n remota de c\u00f3digo porque se pueden cargar archivos PNG v\u00e1lidos especialmente manipulados con contenido PHP inyectado como fondos de escritorio o pantallas de bloqueo. Despu\u00e9s de la carga, el script PHP est\u00e1 disponible en la ra\u00edz web. El c\u00f3digo PHP se ejecuta una vez que se accede al archivo cargado. Esto permite la ejecuci\u00f3n de c\u00f3digo PHP arbitrario y comandos del sistema operativo en el dispositivo como \"www-data\"."}], "lastModified": "2024-12-20T21:15:08.473", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf"}