PT-2023-17191 · Unknown · Yoga Class Registration System

Carlos Bello · Publicado 2023-06-24 · Atualizado 2023-06-30 · CVE-2023-1722

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yoga Class Registration System version 1.0

Description The issue allows an administrator to execute commands on the server due to incorrect validation of thumbnails of classes uploaded by administrators.

Recommendations For Yoga Class Registration System version 1.0, consider disabling the thumbnail upload feature for administrators until a proper validation mechanism is implemented to prevent command execution on the server.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-1722

Produtos afetados

Yoga Class Registration System

Referências · 5

• 🔥 https://fluidattacks.com/advisories/wyckoff · Exploit
• https://t.me/cvenotify/53376 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1722 · Aviso do Fabricante
• https://sourcecodester.com/php/16097/yoga-class-registration-system-php-and-mysql-free-source-code.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1722 · Nota de Segurança