PT-2023-31918 · Unknown · Resumable.Php

Williamdes · Publicado 2023-12-26 · Atualizado 2024-01-04 · CVE-2023-52086

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions resumable.php versions 0.1.4 through 3c6dbf5

Description The issue allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. It is noted that file overwrite has not been possible with the code available in GitHub in recent years.

Recommendations For versions 0.1.4 through 3c6dbf5, consider disabling the upload.php script until a patch is available to prevent arbitrary file uploads. Restrict access to the upload.php endpoint to minimize the risk of exploitation. Avoid using the ../ path traversal in the multipart/form-data content to prevent uploading files to unintended locations.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-52086

Produtos afetados

Resumable.Php

Referências · 10

• https://github.com/dilab/resumable.php/pull/39/commits/408f54dff10e48befa44d417933787232a64304b · Correção
• https://github.com/dilab/resumable.php/pull/27/commits/3e3c94d0302bb399a7611b4738a5a4dd0832a926 · Correção
• https://github.com/dilab/resumable.php/commit/3c6dbf5170b01cbb712013c7d0a83f5aac45653b · Correção
• https://github.com/dilab/resumable.php/pull/39/commits/d3552efd403e2d87407934477eee642836cab3b4 · Correção
• https://github.com/dilab/resumable.php/issues/34 · Nota
• https://osv.dev/vulnerability/CVE-2023-52086 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-52086 · Nota de Segurança
• https://t.me/cvenotify/66153 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1739735754673143981 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1739712324259168461 · Publicação no Twitter