CVE-2024-44023: Path Traversal in ABCApp Creator

The Path Traversal vulnerability allows an attacker to include arbitrary files from the server's filesystem. By manipulating file paths, an attacker can potentially read sensitive configuration files, source code, or even execute malicious code through PHP's include functionality. Successful exploitation could lead to complete system compromise, data breaches, and denial of service. The ability to include arbitrary files significantly expands the attack surface beyond simple information disclosure, potentially enabling remote code execution depending on the files included.

1. Reserved2024-08-18
2. Published2024-10-05
3. Modified2024-10-07
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-44023 is to upgrade ABCApp Creator to version 1.1.3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing strict file access controls on the server to limit the attacker's ability to read sensitive files. Web Application Firewalls (WAFs) can be configured with rules to block requests containing path traversal attempts (e.g., ../ sequences). Review and restrict the permissions of the PHP user account to minimize potential damage if exploitation occurs. After upgrading, confirm the vulnerability is resolved by attempting a path traversal request and verifying that access is denied.