CVE-2018-25094 is a path traversal vulnerability affecting the Online Accounting System (kotchasan online_accounting_system) up to version 1.4.0. Specifically, it allows an unauthenticated attacker to manipulate the 'fid' argument in the ckeditor/filemanager/browser/default/image.php component to access arbitrary files outside the intended directory. Rated with a CVSS score of 7.5 (HIGH), this vulnerability is easily exploitable over the network with low attack complexity, requiring no user interaction or privileges. A successful exploit could lead to high confidentiality impact, allowing attackers to read sensitive system files like /etc/passwd. While the exploit has been publicly disclosed, there is no evidence of active exploitation, nor are there readily available Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal. Organizations are advised to upgrade to version 2.0.0 to remediate this issue.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.0.0CPE matchmatch criteria | cpe:2.3:a:kotchasan:online_accounting_system:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.