PT-2023-24247 · Unknown · Labcollector

Toxich4 · Publicado 2023-06-12 · Atualizado 2023-07-21 · CVE-2023-33253

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LabCollector versions 6.0 through 6.15

Description The issue allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The problem is due to insufficient validation of the file being sent, such as files with names like shell.jpg.php.shell. This vulnerability is in the message function.

Recommendations For versions 6.0 through 6.15, consider disabling the message function until a patch is available to prevent remote code execution. Restrict access to file uploads to minimize the risk of exploitation. Avoid using the file upload feature in the affected versions until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-33253

Produtos afetados

Labcollector

Referências · 7

• 🔥 https://github.com/Toxich4/CVE-2023-33253 · Exploit
• https://labcollector.com · Nota
• https://labcollector.com/changelog-labcollector · Nota
• https://t.me/cvenotify/54655 · Publicação no Telegram
• https://t.me/cibsecurity/65133 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33253 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33253 · Nota de Segurança