An unauthenticated attacker can exploit this flaw by sending an email containing a malicious PHP script as an attachment to a mailbox monitored by the GestSup IMAP connector. The application subsequently saves this attachment directly to a web-accessible directory, specifically the upload/ticket folder. By navigating to the URL of the uploaded file, an attacker can trigger the execution of the PHP script, gaining unauthorized code execution on the underlying server. This flaw poses a high risk to organizations relying on the IMAP integration for automated ticket creation.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the web server hosting GestSup. This can lead to full system compromise, data theft from the ticketing system, and potential lateral movement into the internal network environment.

Recommendation

• Immediately upgrade GestSup to version 3.2.61 or later to implement proper file extension validation.
• Restrict access to the upload/ticket directory via web server configuration to prevent direct execution of PHP or other script files.
• Audit the upload/ticket directory for any unauthorized PHP files or anomalous scripts that may have been uploaded via the IMAP connector.