CVE-2023-33604 in Imperial
Summary
by MITRE • 06/07/2023
Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php. This vulnerability is exploited by attackers via a crafted POST request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 01/05/2026
The vulnerability identified as CVE-2023-33604 affects Imperial CMS version 7.5 and represents a critical arbitrary file deletion flaw within the content management system's file management functionality. This vulnerability resides in the DelspReFile function located within the /sp/ListSp.php file, which processes user requests for file deletion operations. The flaw allows attackers to manipulate the file deletion process through crafted POST requests, potentially enabling unauthorized removal of critical system files, user data, or application components that could compromise the entire platform's integrity and availability.
The technical exploitation of this vulnerability stems from insufficient input validation and authorization checks within the file deletion mechanism. When a POST request is sent to the vulnerable endpoint, the application fails to properly validate user input parameters that determine which files should be deleted. This lack of proper sanitization creates an opportunity for attackers to manipulate the target file paths and execute arbitrary deletion operations on the server filesystem. The vulnerability aligns with CWE-22, which describes improper limitation of a pathname to a restricted directory, commonly known as path traversal attacks. Attackers can leverage this weakness to navigate beyond intended directories and delete files that should remain protected, potentially leading to complete system compromise or data loss.
The operational impact of this vulnerability extends beyond simple file deletion capabilities and represents a significant threat to system security and business continuity. An attacker who successfully exploits this vulnerability can potentially remove critical application files, configuration data, user databases, or even system executables that could render the CMS inoperable or provide access to underlying system resources. The attack surface is particularly concerning as it operates at the file system level, allowing for potential privilege escalation and persistence mechanisms. From an adversarial perspective, this vulnerability maps to ATT&CK technique T1070.004, which involves the deletion of files and logs to evade detection and maintain access within compromised systems.
Mitigation strategies for CVE-2023-33604 should prioritize immediate patching of the affected Imperial CMS version 7.5 to address the root cause of the arbitrary file deletion vulnerability. Organizations should implement robust input validation and parameter sanitization measures to prevent malicious manipulation of file paths within the application's file management functions. Network segmentation and access controls should be enforced to limit exposure of the vulnerable endpoint to untrusted users. Additionally, implementing web application firewalls with custom rules to detect and block suspicious POST requests targeting the vulnerable file deletion functionality can provide additional defense layers. Regular security audits and vulnerability assessments should be conducted to identify similar weaknesses in other components of the application stack, particularly focusing on file system operations and user privilege controls. System administrators should also establish comprehensive backup and recovery procedures to ensure rapid restoration capabilities in case of successful exploitation attempts.