PT-2023-29086 · Unknown · Codecanyon Credit Lite

Skalvin · Publicado 2023-08-18 · Atualizado 2024-05-17 · CVE-2023-4407

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Codecanyon Credit Lite version 1.5.4

Description A critical vulnerability was found in the component POST Request Handler, specifically in the file /portal/reports/account statement. The manipulation of the date1 and date2 arguments leads to SQL injection. The attack can be launched remotely.

Recommendations For Codecanyon Credit Lite version 1.5.4, consider disabling the /portal/reports/account statement endpoint until a patch is available. Restrict access to the POST Request Handler component to minimize the risk of exploitation. Avoid using the date1 and date2 arguments in the affected endpoint until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-4407

Produtos afetados

Codecanyon Credit Lite

Referências · 9

• 🔥 http://packetstormsecurity.com/files/174244/Credit-Lite-1.5.4-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/51701 · Exploit
• https://t.me/cvenotify/56854 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-4407 · Nota de Segurança
• https://t.me/cibsecurity/68827 · Publicação no Telegram
• https://vuldb.com/?id.237511 · Nota
• https://t.me/cvenotify/56851 · Publicação no Telegram
• https://vuldb.com/?ctiid.237511 · Nota
• https://osv.dev/vulnerability/CVE-2023-4407 · Aviso do Fabricante