PT-2023-23492 · Unknown · Sourcecodester Online Computer/Laptop Store

Jadore147258369 · Publicado 2023-05-16 · Atualizado 2025-01-23 · CVE-2023-31857

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Computer and Laptop Store version 1.0

Description The issue allows unrestricted file upload, which can lead to remote code execution. The vulnerability path is "/classes/Users.php?f=save".

Recommendations For version 1.0, restrict access to the "/classes/Users.php?f=save" endpoint to minimize the risk of exploitation. Consider implementing proper file upload validation and sanitization to prevent malicious file uploads. As a temporary workaround, consider disabling the file upload functionality in the Users.php file until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-31857

Produtos afetados

Sourcecodester Online Computer/Laptop Store

Referências · 5

• 🔥 https://github.com/Jadore147258369/php-ocls/blob/main/README.md · Exploit
• https://t.me/cibsecurity/64210 · Publicação no Telegram
• https://t.me/cvenotify/108366 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-31857 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31857 · Nota de Segurança