CVE-2023-27179

What it actually does

GDidees CMS 3.9.1 and earlier exposes an arbitrary file download flaw in the /_admin/imgdownload.php endpoint. The vulnerable filename parameter does not sufficiently constrain the requested file to an intended image/download directory, allowing unauthenticated remote attackers to use path traversal sequences to read files elsewhere on the web server filesystem. The primary impact is confidentiality loss: attackers may retrieve application configuration files, source code, credentials, database connection strings, backups, logs, or operating-system-readable files accessible to the web server process. The CVSS vector indicates network exploitation, low complexity, no authentication, and no user interaction, with high confidentiality impact but no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose sensitive business data and application secrets without requiring a login. If attackers retrieve configuration files or credentials, they may be able to pivot into the CMS database, administrative interfaces, hosting control panels, or other connected services. Because exploit maturity is reported as weaponized and the EPSS score is high, internet-facing GDidees CMS deployments should be treated as likely targets for automated scanning and opportunistic exploitation, even though the vulnerability is not currently listed in CISA KEV and is not specifically associated with ransomware campaigns.

How an attack unfolds

An attacker first identifies a site running GDidees CMS, often by fingerprinting page structure, static assets, headers, or known administrative paths. The attacker then sends crafted HTTP requests to /_admin/imgdownload.php with the filename parameter set to traversal payloads that escape the intended download directory. By iterating over common file names and locations, the attacker attempts to retrieve sensitive files such as CMS configuration files, database credentials, PHP source files, backups, logs, or host-level files readable by the web server user. If secrets are recovered, the attacker may use them for follow-on access, such as connecting to a database, logging into administrative services, modifying the site through separate weaknesses, or expanding access to adjacent systems. Because the issue is unauthenticated and simple to automate, exploitation commonly appears as repeated GET requests containing ../ or encoded traversal sequences in the filename parameter.

How to fix it

Upgrade GDidees CMS to a vendor version that explicitly fixes this arbitrary file download issue if one is available. No fixed version was provided in the vulnerability metadata, so organizations running GDidees CMS 3.9.1 or earlier should consult the vendor or project maintainer and prioritize migration, patching, or compensating controls. If immediate upgrade is not possible, restrict access to /_admin/ and specifically /_admin/imgdownload.php to trusted administrative networks, require authentication before file download functionality, and block traversal payloads at the web server or WAF layer. Remove or disable the vulnerable imgdownload.php endpoint if it is not business-critical. At the code level, downloads should be implemented with strict server-side allowlists, canonical path validation using realpath-style resolution, rejection of absolute paths and traversal sequences, and enforcement that resolved paths remain inside a dedicated download directory. Ensure sensitive configuration files, backups, logs, and credentials are not stored under web-accessible paths and have minimal filesystem permissions for the web server account.

How to confirm the fix worked

Confirm the deployed GDidees CMS version is newer than 3.9.1 or that the vulnerable endpoint has been patched, removed, or access-controlled. Test the endpoint using benign traversal validation payloads in a controlled manner and verify that attempts to access files outside the intended image/download directory return 400, 403, 404, or another safe error response rather than file contents. Review web server and application configuration to ensure /_admin/ is not anonymously reachable from the internet unless explicitly required. Validate WAF or reverse proxy rules by attempting URL-encoded and double-encoded traversal patterns. Confirm sensitive files such as application configuration, backups, and logs cannot be downloaded through /_admin/imgdownload.php. Where source review is possible, verify the filename parameter is not used directly in filesystem reads and that canonical path checks constrain access to an approved directory.

Typical attack path

1. Discover or fingerprint a public site running GDidees CMS 3.9.1 or earlier.
2. Probe the administrative download endpoint at /_admin/imgdownload.php.
3. Send crafted requests with filename values containing path traversal sequences such as ../ or URL-encoded equivalents.
4. Attempt to download sensitive files, including CMS configuration files, PHP source code, database credential files, backups, logs, or operating system files readable by the web server process.
5. Use any recovered credentials or secrets to access databases, administrative panels, hosting services, or other connected systems.
6. Perform follow-on reconnaissance, data theft, or persistence using credentials obtained from the downloaded files.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF events, and application logs for requests to /_admin/imgdownload.php where the filename parameter contains traversal sequences, encoded dots or slashes, absolute paths, or names of sensitive files. Pay particular attention to repeated requests from the same source cycling through common targets such as configuration files, password files, logs, backups, and PHP source files. Indicators of possible successful exploitation include HTTP 200 responses with unusually large response sizes, downloads of non-image content from imgdownload.php, responses whose byte size matches known sensitive files, or requests for files such as /etc/passwd, win.ini, config.php, .env, database backups, or CMS configuration files. Correlate suspicious download attempts with subsequent authentication events, database connections, administrative logins, file uploads, or content changes from the same IP address or user agent. If successful disclosure is suspected, perform credential rotation and review downstream systems that may use secrets stored in CMS configuration files.

• GET /_admin/imgdownload.php?filename=../
• POST /_admin/imgdownload.php
• /_admin/imgdownload.php?filename=..%2f
• /_admin/imgdownload.php?filename=%2e%2e%2f
• /_admin/imgdownload.php?filename=..%252f
• /_admin/imgdownload.php?filename=%252e%252e%252f
• /_admin/imgdownload.php?filename=../../
• /_admin/imgdownload.php?filename=..\
• /_admin/imgdownload.php?filename=%2e%2e%5c
• /_admin/imgdownload.php?filename=/etc/passwd
• /_admin/imgdownload.php?filename=../../../../etc/passwd
• /_admin/imgdownload.php?filename=c:%5cwindows%5cwin.ini
• /_admin/imgdownload.php?filename=../../../../windows/win.ini
• /_admin/imgdownload.php?filename=.env
• /_admin/imgdownload.php?filename=../.env
• /_admin/imgdownload.php?filename=config.php
• /_admin/imgdownload.php?filename=../config.php
• /_admin/imgdownload.php?filename=../../config.php
• /_admin/imgdownload.php?filename=database.php
• /_admin/imgdownload.php?filename=backup
• /_admin/imgdownload.php?filename=.htaccess
• filename=../
• filename=..%2f
• filename=%2e%2e%2f
• filename=..%252f
• filename=%252e%252e%252f

What your security team should do

• Inventory all internet-facing and internal deployments of GDidees CMS and identify versions 3.9.1 and earlier.
• Prioritize remediation for public-facing instances because exploitation is unauthenticated, low-complexity, and reported as weaponized with a high EPSS score.
• Upgrade, patch, remove, or access-restrict /_admin/imgdownload.php as soon as practical; if no vendor fix is available, implement compensating controls immediately.
• Deploy WAF or reverse proxy rules blocking path traversal patterns in the filename parameter to /_admin/imgdownload.php, including URL-encoded variants.
• Review historical web access logs for exploitation attempts and successful downloads of sensitive files through the vulnerable endpoint.
• Rotate database passwords, API keys, CMS administrator credentials, and other secrets if logs indicate likely successful file disclosure or if sensitive configuration files may have been exposed.
• Harden filesystem permissions so the web server process cannot read unnecessary configuration files, backups, private keys, or logs.
• Remove web-accessible backups, archives, exported databases, and old configuration copies from CMS directories.
• Monitor for follow-on activity using credentials potentially exposed through configuration file disclosure, especially unusual database logins, CMS administrator logins, and file modifications.