PT-2023-31914 · Lychee · Lychee

Highildyria · Publicado 2023-12-28 · Atualizado 2024-01-04 · CVE-2023-52082

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 5.0.2

Description Lychee, a free photo-management tool, is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the .env settings set to DB LOG SQL=true and DB LOG SQL EXPLAIN=true. The defaults settings of Lychee are safe. It is estimated that around 7,328 devices are potentially affected, mainly distributed in China, Germany, and other countries.

Recommendations To work around this issue, disable SQL EXPLAIN logging. For versions prior to 5.0.2, update to version 5.0.2 to resolve the issue.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2023-52082

GHSA-RJWV-5J3M-P5X4

Produtos afetados

Lychee

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52082.json · Exploit
• https://github.com/LycheeOrg/Lychee/security/advisories/GHSA-rjwv-5j3m-p5x4 · Aviso do Fabricante
• https://github.com/LycheeOrg/Lychee/commit/33354a2ce7cf700cc4ee537b7b8b94dfc1e84ad4 · Correção
• https://twitter.com/HunterMapping/status/1740658621061750928 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1740425678518878549 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1740400415269880124 · Publicação no Twitter
• https://twitter.com/zoomeye_team/status/1741092256877302092 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-52082 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-52082 · Nota de Segurança