PT-2023-27855 · Unknown · Student Information System

Andres Roldan · CVE-2023-4122 · Publicado 2023-12-07 · Atualizado 2023-12-11

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Student Information System version 1.0

Description The issue allows an authenticated attacker to obtain Remote Code Execution on the server hosting the application through an Insecure File Upload vulnerability. This vulnerability is specifically located on the photo parameter of the "my-profile" page.

Recommendations For Student Information System version 1.0, as a temporary workaround, consider disabling the file upload functionality on the "my-profile" page, specifically restricting access to the photo parameter, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-4122

Produtos afetados

Student Information System

Referências · 9

• 🔥 https://fluidattacks.com/advisories/rubinstein · Exploit
• https://twitter.com/cracbot/status/1733259775335387431 · Publicação no Twitter
• https://t.me/cvenotify/62842 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-4122 · Nota de Segurança
• https://t.me/cvenotify/62887 · Publicação no Telegram
• https://kashipara.com · Nota
• https://twitter.com/CVEnew/status/1732904802231959741 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4122 · Aviso do Fabricante
• https://twitter.com/DavidDeMaya/status/1734124050891354416 · Publicação no Twitter