PT-2023-31029 · Unknown+1 · Phpsysinfo+1

Namiltd · Publicado 2023-12-19 · Atualizado 2024-01-02 · CVE-2023-49006

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phpsysinfo version 3.4.3

Description A Cross Site Request Forgery (CSRF) issue allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. The functionality is disabled by default in Phpsysinfo 3.4.3, but users may enable the vulnerable functionality.

Recommendations For Phpsysinfo version 3.4.3, consider disabling the vulnerable functionality related to the XML.php file until a patch is available. As a temporary workaround, restrict access to the XML.php file to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-49006

GHSA-67GV-XRW7-P72W

Produtos afetados

Debian

Phpsysinfo

Referências · 17

• 🔥 https://github.com/Hebing123/cve/issues/5 · Exploit
• 🔥 https://huntr.com/bounties/ca6d669f-fd82-4188-aae2-69e08740d982 · Exploit
• https://github.com/phpsysinfo/phpsysinfo/commit/4f2cee505e4f2e9b369a321063ff2c5e0c34ba45 · Correção
• https://github.com/phpsysinfo/phpsysinfo · Nota
• https://twitter.com/CVEnew/status/1737041804355133498 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49006 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49006 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2023-49006 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49006 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-49006 · Nota de Segurança
• https://t.me/cvenotify/65941 · Publicação no Telegram
• https://t.me/cvenotify/64108 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1737079505942909137 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-67gv-xrw7-p72w · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-49006 · Aviso do Fabricante