PT-2023-25810 · Unknown · Projectworlds Online Art Gallery Project

Noflag · Publicado 2023-07-10 · Atualizado 2024-08-02 · CVE-2023-37152

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Projectworlds Online Art Gallery Project version 1.0

Description The issue allows unauthenticated users to perform arbitrary file uploads via the "adminHome.php" page. However, it is noted that the validity of this issue has been disputed.

Recommendations For Projectworlds Online Art Gallery Project version 1.0, as a temporary workaround, consider restricting access to the "adminHome.php" page to prevent arbitrary file uploads until the dispute is resolved or a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-37152

Produtos afetados

Projectworlds Online Art Gallery Project

Referências · 7

• 🔥 https://github.com/Trinity-SYT-SECURITY/arbitrary-file-upload-RCE/blob/main/Online%20Art%20gallery%20project%201.0.md · Exploit
• 🔥 https://exploit-db.com/exploits/51524 · Exploit
• https://chtsecurity.com/news/ad3cee07-3e35-45c0-97f9-811cce13dda9 · Nota
• https://chtsecurity.com/news/afe25fb4-55ac-45d9-9ece-cbc1edda2fb2%20 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-37152 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-37152 · Aviso do Fabricante
• https://t.me/cvenotify/88605 · Publicação no Telegram