CVE-2023-6893: A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/...

Summary

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conver...

What to do

Update hikvision intercom_broadcast_system to version 4.1.0 or later.

Affected software

Vendor	Product	Affected versions
hikvision	intercom_broadcast_system	>= 3.0.3, < 4.1.0 `cpe:2.3:o:hikvision:intercom_broadcast_system::::::::`

Original advisory text

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/...

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252.

References

https://github.com/willchen0011/cve/blob/main/download.md Exploit Third Party Advisory
https://vuldb.com/?ctiid.248252 Permissions Required Third Party Advisory
https://vuldb.com/?id.248252 Third Party Advisory