Hydrosystem Control System Missing Authorization Vulnerability Allowing Unauthorized File Access and Execution

A vulnerability exists in Hydrosystem Control System prior to version 9.8.5, where the application fails to enforce proper authorization for certain directories. This oversight enables unauthorized users to read and execute files within these directories. Notably, attackers can directly run PHP scripts on the connected database, potentially leading to severe consequences.

Impact

Exploitation of this vulnerability allows unauthorized access to sensitive files and the execution of scripts that can manipulate the connected database.

Remediation

Users can upgrade to Hydrosystem Control System version 9.8.5 or later to address this vulnerability.