PT-2023-29007 · Unknown · Super Store Finder

Publicado 2023-10-02 · Atualizado 2024-09-23 · CVE-2023-43835

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Super Store Finder versions 3.7 and below

Description The issue allows for authenticated Arbitrary PHP Code Injection, potentially leading to Remote Code Execution when settings overwrite config.inc.php content.

Recommendations For Super Store Finder versions 3.7 and below, update to a version above 3.7 to resolve the issue. As a temporary workaround, consider restricting access to the config.inc.php file to minimize the risk of exploitation. Avoid using the settings overwrite feature in the affected versions until the issue is resolved.

Exploit

Correção

RCE

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2023-43835

Produtos afetados

Super Store Finder

Referências · 6

• 🔥 https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html · Exploit
• https://t.me/cibsecurity/71433 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1708977487965716691 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-43835 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-43835 · Aviso do Fabricante
• https://t.me/cvenotify/95697 · Publicação no Telegram