PT-2023-29788 · Sourcecodester · Sourcecodester Best Courier Management System

Zerrr0 · Publicado 2023-10-18 · Atualizado 2023-10-25 · CVE-2023-46004

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Best Courier Management System version 1.0

Description The issue concerns an arbitrary file upload vulnerability in the update user function. This allows for potential malicious file uploads. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Sourcecodester Best Courier Management System version 1.0, consider disabling the update user function until a patch is available to prevent arbitrary file uploads. Restrict access to file upload features to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-46004

Produtos afetados

Sourcecodester Best Courier Management System

Referências · 7

• 🔥 https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/Arbitrary-File-Upload-Vulnerability.md · Exploit
• https://t.me/cvenotify/59673 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-46004 · Aviso do Fabricante
• https://t.me/latest_high_impact_cve/46 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-46004 · Nota de Segurança
• https://twitter.com/IT_securitynews/status/1716387201787785609 · Publicação no Twitter
• https://t.me/cibsecurity/72518 · Publicação no Telegram