PT-2017-13637 · Claydip · Claydip Laravel Airbnb Clone

Ihsan Sencan · Publicado 2017-09-26 · Atualizado 2017-10-10 · CVE-2017-14704

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Claydip Laravel Airbnb Clone version 1.0

Description The issue concerns unrestricted file upload vulnerabilities in the imageSubmit and proof submit functions. This allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via a direct request to the file in images/profile.

Recommendations For Claydip Laravel Airbnb Clone version 1.0, consider disabling the imageSubmit and proof submit functions until a patch is available to prevent remote authenticated users from uploading executable files. Restrict access to the images/profile directory to minimize the risk of exploitation. Avoid allowing uploads of files with executable extensions in these functions.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2017-14704

Produtos afetados

Claydip Laravel Airbnb Clone

Referências · 3

• 🔥 https://exploit-db.com/exploits/42773 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14704 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14704 · Nota de Segurança