An authenticated OS command injection vulnerability in ICEcoder versions 8.0 through 8.1 allows remote attackers to execute arbitrary code with web-server privileges.

The application fails to sanitize directory names before passing them to a system shell command within the lib/properties.php file. An authenticated attacker can create a directory containing shell metacharacters and trigger the Properties function to execute malicious commands via the popen function.

Successful exploitation allows an attacker to gain full control over the web application environment by executing commands as the web-server user. This level of access typically leads to complete data compromise, unauthorized modification of files, and the potential for lateral movement within the network. Given the CVSS score of 8.8, this vulnerability represents a high-risk security flaw that requires immediate attention to prevent system-wide compromise.

Immediate Action: There is currently no official patch available for this vulnerability. Administrators should restrict access to the ICEcoder instance to trusted personnel only and consider disabling the application until a security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting lib/properties.php, particularly those containing shell metacharacters such as semicolons, pipes, or backticks in directory paths. Monitor system process logs for unexpected executions originating from the web server process.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing shell injection patterns. Ensure that the web server process runs with the least privilege necessary to minimize the impact of a potential compromise.

Public Exploit Available: Unknown.

Due to the severity of this remote code execution vulnerability, organizations currently running ICEcoder 8.0 or 8.1 must prioritize securing their environments. Until a vendor patch is issued, implement strict access controls and monitor logs for any signs of exploitation. Once a fix is made available, it should be applied immediately to eliminate the risk of arbitrary command execution.