CVE-2023-23330

Vulnerability

A local file inclusion vulnerability exists in Amano Xparc parking solutions version 7.1.3879. The flaw resides in the web interface of the software, likely within file retrieval or parsing functionality that does not properly sanitize user-supplied file paths, allowing inclusion of local files from the server filesystem [1].

Exploitation

An attacker with network access to the Xparc software can send crafted HTTP requests to the vulnerable endpoint, providing path traversal sequences or absolute paths to retrieve arbitrary files. The official description does not specify authentication requirements, so it may be exploitable without prior authentication [1].

Impact

Successful exploitation allows an attacker to read sensitive files from the server, such as configuration files containing credentials, database connections, or other secrets. This can lead to privilege escalation or further compromise of the parking system [1].

Mitigation

As of the publication date, no fix has been released. Operators should monitor vendor updates at [1] and implement network segmentation to restrict access to the Xparc management interface. The software version 7.1.3879 is affected; upgrading to a later version if released is recommended [1].