PT-2023-20824 · Unknown · Textpattern

Leekenghwa · Publicado 2023-04-12 · Atualizado 2025-02-10 · CVE-2023-26852

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Textpattern versions 4.8.8 and below

Description An arbitrary file upload vulnerability in the upload plugin allows attackers to execute arbitrary code by uploading a crafted PHP file.

Recommendations For Textpattern versions 4.8.8 and below, update to a version above 4.8.8 to resolve the issue. As a temporary workaround, consider disabling the upload plugin until a patch is available. Restrict access to the upload functionality to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-26852

Produtos afetados

Textpattern

Referências · 7

• 🔥 https://github.com/leekenghwa/CVE-2023-26852-Textpattern-v4.8.8-and- · Exploit
• 🔥 https://drive.google.com/drive/folders/1x55FGWZydBRxFyTVIAL1ynnk1X7gfIq9?usp=sharing · Exploit
• https://github.com/textpattern/textpattern · Nota
• https://t.me/cibsecurity/61977 · Publicação no Telegram
• https://t.me/cvenotify/110610 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26852 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-26852 · Aviso do Fabricante