CyberRota Analysis
AI-GeneratedICEcoder 8.1 is vulnerable to unauthenticated remote code execution due to a combination of authentication and CSRF validation bypasses, allowing attackers to execute arbitrary OS commands. By sending a crafted HTTP POST request, an attacker can exploit this vulnerability to gain control over the server environment, posing a critical risk to any organization using this software. Organizations utilizing ICEcoder should prioritize immediate remediation to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the terminal endpoint with a password parameter to bypass authentication, a non-empty csrf parameter to skip CSRF validation, and an arbitrary command string passed directly to proc_open() to achieve remote code execution as the web-server user.