CVE-2023-24217

published 2023-03-06

CVE-2023-24217: AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.

Priority P2 62 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
agilebio	electronic_lab_notebook	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /login.php↗

url /index.php?controller=user_profile&subcontroller=update↗

url /extra_modules/eln/index.php?page=↗

path ../../../../../..{session_path}/sess_{PHPSESSID}↗

path /var/lib/php/session/↗

cookie PHPSESSID↗

command action=edit&id=1↗

• → Detect LFI traversal attempts targeting the ELN module's `page` parameter with path traversal sequences pointing to PHP session files. ↗
• → Monitor POST requests to `/index.php?controller=user_profile&subcontroller=update` for PHP code injection payloads (e.g., `<?php ... ?>`) embedded in profile fields such as `contact_name`. ↗
• → Alert on GET requests to `/extra_modules/eln/index.php` containing both `page=` with `../` traversal sequences and `action=edit` parameters, which indicate exploitation of the LFI-to-RCE chain. ↗
• → The exploit requires authenticated access; monitor for login followed immediately by a profile update and then an ELN page traversal request within the same session as a behavioral chain indicator. ↗
• → The RCE payload is injected into the user profile, then triggered by loading the PHP session file via LFI; look for session file path patterns (`sess_<PHPSESSID>`) appearing in the `page` query parameter. ↗

• · The exploit assumes PHP session files are stored at the default path `/var/lib/php/session/`; non-default session storage locations will require the attacker to adjust the traversal path, which may alter detection signatures. ↗
• · Exploitation requires valid authenticated credentials; unauthenticated access alone is insufficient to trigger the LFI/RCE chain. ↗
• · The exploit uses random strings for the wrapper and parameter names on each run, meaning static string-based detection of those specific parameter names will not be reliable across executions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-98