PT-2023-19466 · Unknown · Zhong Bang Crmeb

Keyman · Publicado 2023-04-29 · Atualizado 2024-05-17 · CVE-2023-2419

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zhong Bang CRMEB version 4.6.0

Description A critical issue affects the videoUpload function in the file SystemAttachmentServices.php, allowing unrestricted upload through manipulation of the filename argument. This can be initiated remotely. The issue has been publicly disclosed and may be exploited.

Recommendations For Zhong Bang CRMEB version 4.6.0, consider disabling the videoUpload function until a patch is available to prevent unrestricted file uploads. Restrict access to the SystemAttachmentServices.php file to minimize the risk of exploitation. Avoid using the filename argument in the affected function until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-2419

Produtos afetados

Zhong Bang Crmeb

Referências · 6

• 🔥 https://github.com/crmeb/CRMEB/issues/77 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2419 · Nota de Segurança
• https://vuldb.com/?ctiid.227716 · Nota
• https://osv.dev/vulnerability/CVE-2023-2419 · Aviso do Fabricante
• https://vuldb.com/?id.227716 · Nota
• https://t.me/cvenotify/49474 · Publicação no Telegram