The vulnerability of the processimage.php component in the ImpressCMS CMS system allows a hacker to execute arbitrary code.

The vulnerability of the processimage.php component in the ImpressCMS CMS system is related to deficiencies in path name restrictions for the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Unspecified vulnerability in ImpressCMS

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums, and photo albums. ImpressCMS has a security vulnerability that stems from the fact that impress scms prior to 1.4.2 allows traversal of the origName or imageName directory b...

Remote code execution

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

CVE-2022-24977

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...

PT-2022-6872

Name of the Vulnerable Software and Affected Versions ImpressCMS versions prior to 1.4.2 Description The issue is related to insufficient restrictions on the directory path name in the processimage.php component of the ImpressCMS system. This can be exploited by a remote attacker to execute...

CVE-2022-24977: Improper Limitation of a Pathname to a Restricted Directory

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHPSESSIONUPLOADPROGRESS when the PHP installation supports...