PT-2019-13502 · Layerbb · Layerbb

Publicado 2019-07-19 · Atualizado 2019-07-19 · CVE-2019-13973

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.3

Description The issue allows for arbitrary file upload in the admin/general.php file due to the lack of restriction on the custom logo filename suffix, enabling the use of .php suffixes.

Recommendations For LayerBB version 1.1.3, restrict the custom logo filename suffix to prevent the use of .php extensions as a temporary workaround, and update to a newer version that addresses this issue once available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-13973

Produtos afetados

Layerbb

Referências · 3

• 🔥 http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13973 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13973 · Aviso do Fabricante