CVE-2023-25240: 
PHP vulnerability analysis and mitigation

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. The vulnerability stems from incorrect sanitization of PHPSESSID cookie session management connection requests, where sessions are not properly validated and cookie values are not changed for each connection (NVD, GitHub).

The vulnerability exists due to improper handling of PHPSESSID cookies where the same session can be used on multiple computers with different IPs from one network. The system does not properly validate sessions or change cookies for each connection POST request. This allows an attacker in the same network to steal an administrator's cookie and reuse the same session from different machines within that network. The vulnerability affects versions 10.5.15, 10.5.16, and up to 10.5.20 (GitHub).

An attacker who successfully exploits this vulnerability can steal authenticated user sessions, particularly administrator sessions. Once a cookie is stolen, the attacker can manipulate the same session to perform malicious actions with the privileges of the authenticated user, including logging out users or executing other unauthorized actions. The attack is possible both in internal and external networks (GitHub).