PT-2023-20048 · Unknown · Cleverstupiddog Yf-Exam

Cleverstupiddog · Publicado 2023-03-03 · Atualizado 2023-03-10 · CVE-2023-25402

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CleverStupidDog yf-exam version 1.8.0

Description The issue concerns a lack of restriction on the suffix of uploaded files, allowing any file to be uploaded.

Recommendations For version 1.8.0, restrict access to the file upload feature until a proper fix is implemented to validate and restrict file types based on their suffix. As a temporary workaround, consider implementing server-side checks to only allow specific, safe file extensions to be uploaded.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-25402

Produtos afetados

Cleverstupiddog Yf-Exam

Referências · 5

• 🔥 https://github.com/CleverStupidDog/yf-exam/issues/1 · Exploit
• 🔥 https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-25402 · Exploit
• https://osv.dev/vulnerability/CVE-2023-25402 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25402 · Nota de Segurança
• https://t.me/cibsecurity/59418 · Publicação no Telegram