CVE-2024-34523

2024-05-0700:00:00

mitre

github.com

achecker

remote attackers

arbitrary files

download.php path parameter

unauthenticated path traversal

readfile

php

vulnerability

no longer supported

maintainer

AI Score

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

partial

JSON

AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. This occurs through readfile in PHP. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:inclusive-design:achecker:-:*:*:*:*:*:*:*"
    ],
    "vendor": "inclusive-design",
    "product": "achecker",
    "versions": [
      {
        "status": "affected",
        "version": "1.5"
      }
    ],
    "defaultStatus": "unknown"
  }
]