CVE-2023-24736
📋 TL;DR
PMB v7.4.6 contains a remote code execution vulnerability in the /sauvegarde/restaure_act.php component that allows attackers to execute arbitrary code on affected systems. This affects all organizations running vulnerable versions of PMB software with the vulnerable component accessible.
💻 Affected Systems
- PMB (PhpMyBibli)
📦 What is this software?
Pmb by Sigb
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install malware, pivot to other systems, and maintain persistent access.
Likely Case
Attackers gain shell access to the web server, allowing them to read sensitive files, modify content, and potentially escalate privileges to the underlying operating system.
If Mitigated
Limited impact due to network segmentation, proper access controls, and monitoring that detects exploitation attempts before successful compromise.
🎯 Exploit Status
The GitHub repository contains exploit code, making this easily weaponizable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check for official PMB updates or patches. If none available, implement workarounds immediately.
🔧 Temporary Workarounds
Disable vulnerable component
linuxRemove or restrict access to the /sauvegarde/restaure_act.php file
mv /path/to/pmb/sauvegarde/restaure_act.php /path/to/pmb/sauvegarde/restaure_act.php.disabled
chmod 000 /path/to/pmb/sauvegarde/restaure_act.php
Web server access restriction
allConfigure web server to block access to the vulnerable endpoint
# Apache: Add to .htaccess or virtual host config
<Location "/sauvegarde/restaure_act.php">
Deny from all
</Location>
# Nginx: Add to server block
location = /sauvegarde/restaure_act.php {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PMB systems from critical infrastructure
- Deploy web application firewall (WAF) rules to block requests to /sauvegarde/restaure_act.php
🔍 How to Verify
Check if Vulnerable:
Check if PMB version is 7.4.6 and if /sauvegarde/restaure_act.php is accessible via HTTP requestsCheck Version:
Check PMB configuration files or database for version information, typically in includes/version.php or similarVerify Fix Applied:
Test that /sauvegarde/restaure_act.php returns 403/404 error or is inaccessible📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /sauvegarde/restaure_act.php with suspicious parameters
- Unusual process execution from web server user
- File uploads or modifications in unexpected locations
Network Indicators:
- HTTP POST requests to /sauvegarde/restaure_act.php with command-like parameters
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_server_logs" AND (uri="/sauvegarde/restaure_act.php" OR uri LIKE "%/sauvegarde/restaure_act.php%")