Executive brief
ICEcoder is a browser-based code editor that allows developers to write and maintain websites from any browser. An authenticated attacker can inject arbitrary operating system commands by creating directories with shell metacharacters in their names and accessing the Properties function, leading to command execution with the privileges of the web server process and potential full system compromise.
Technical details
ICEcoder through version 8.1 contains an OS command injection vulnerability in lib/properties.php where an unescaped filesystem path is passed into a shell command via popen(). The vulnerability occurs because user-controllable directory names are concatenated directly into a shell command without proper escaping or sanitization. An authenticated attacker can exploit this by creating directories with embedded shell metacharacters (e.g., backticks, dollar signs, semicolons) in their names. When the Properties function processes these malicious directory names, the shell interprets the metacharacters and executes arbitrary commands as the web server user. No patch is currently available, as the project appears to be abandoned.
Affected products
- ICEcoder ICEcoder through 8.1
Timeline
- 2026-09-10: disclosed
- other: Package marked as abandoned and no longer maintained as of 2023-12-17