PT-2023-32587 · Byzoro+1 · Byzoro Smart S80+1

Car01 · Publicado 2023-11-24 · Atualizado 2024-05-17 · CVE-2023-6274

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Byzoro Smart S80 versions up to 20231108 Beijing Baichuo Smart S80 versions up to 20231108

Description A critical issue affects an unknown functionality of the file /sysmanage/updatelib.php of the component PHP File Handler. The manipulation of the file upload argument leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For Byzoro Smart S80 versions up to 20231108, consider disabling the file upload argument in the /sysmanage/updatelib.php file until a patch is available. For Beijing Baichuo Smart S80 versions up to 20231108, consider disabling the file upload argument in the /sysmanage/updatelib.php file until a patch is available. As a temporary workaround, restrict access to the /sysmanage/updatelib.php file to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-6274

Produtos afetados

Beijing Baichuo Smart S80

Byzoro Smart S80

Referências · 7

• 🔥 https://github.com/Carol7S/cve/blob/main/rce.md · Exploit
• https://vuldb.com/?submit.234888 · Nota
• https://t.me/cvenotify/61095 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-6274 · Aviso do Fabricante
• https://vuldb.com/?id.246103 · Nota
• https://vuldb.com/?ctiid.246103 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-6274 · Nota de Segurança