PT-2023-18910 · Avantfax · Avantfax

Harold Rodriguez · Publicado 2023-03-10 · Atualizado 2025-03-04 · CVE-2023-23328

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AvantFAX version 3.3.7

Description A File Upload issue exists, allowing an authenticated user to bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.

Recommendations For AvantFAX version 3.3.7, consider disabling the file upload functionality in FileUpload.php until a patch is available to prevent exploitation. Restrict access to the FileUpload.php module to minimize the risk of uploading specially crafted PHP files.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-23328

Produtos afetados

Avantfax

Referências · 7

• 🔥 https://github.com/superkojiman/vulnerabilities/blob/master/AvantFAX-3.3.7/README.md · Exploit
• https://t.me/cibsecurity/59854 · Publicação no Telegram
• https://t.me/cvenotify/113466 · Publicação no Telegram
• http://avantfax.com · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-23328 · Aviso do Fabricante
• https://t.me/cvenotify/46343 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-23328 · Nota de Segurança