PT-2023-29009 · Unknown · Prison Management System

Rootd4Ddy · Publicado 2023-10-04 · Atualizado 2023-10-07 · CVE-2023-43838

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Personal Management System version 1.4.64

Description The issue allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.

Recommendations For Personal Management System version 1.4.64, consider disabling the file upload feature, specifically for SVG files, until a patch is available. Restrict access to the user profile's avatar upload functionality to minimize the risk of exploitation. Avoid using the file upload feature in user profiles until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-43838

Produtos afetados

Prison Management System

Referências · 10

• 🔥 https://github.com/rootd4ddy/CVE-2023-43838 · Exploit
• https://github.com/Volmarg/personal-management-system/blob/39d3c0df641a5435f2028b37a27d26ba61a3b97b/src/assets/scripts/core/ui/DataProcessor/SpecialAction.ts#L35 · Aviso do Fabricante
• https://github.com/Volmarg/personal-management-system · Nota
• http://w3.org/2000/svg · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-43838 · Nota de Segurança
• https://twitter.com/IT_securitynews/status/1710598170986553808 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-43838 · Aviso do Fabricante
• https://github.com/Volmarg · Nota
• https://github.com/rootd4ddy · Nota
• https://t.me/cibsecurity/71605 · Publicação no Telegram