cve/2023/CVE-2023-25266.md

### [CVE-2023-25266](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25266)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

An issue was discovered in Docmosis Tornado prior to version 2.9.5. An authenticated attacker can change the Office directory setting pointing to an arbitrary remote network path. This triggers the execution of the soffice binary under the attackers control leading to arbitrary remote code execution (RCE).

### POC

#### Reference
- https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html
- https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html

#### Github
No PoCs found on GitHub currently.
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00			`### [CVE-2023-25266](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25266)`
			`![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)`
			`![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)`

			`### Description`

			`An issue was discovered in Docmosis Tornado prior to version 2.9.5. An authenticated attacker can change the Office directory setting pointing to an arbitrary remote network path. This triggers the execution of the soffice binary under the attackers control leading to arbitrary remote code execution (RCE).`

			`### POC`

			`#### Reference`
			`- https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html`
Update CVE sources 2024-06-09 00:33 2024-06-09 00:33:16 +00:00			`- https://frycos.github.io/vulns4free/2023/01/24/0days-united-nations.html`
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00
			`#### Github`
			`No PoCs found on GitHub currently.`