PT-2023-32855 · Unknown · Phpgurukul Online Notes Sharing System

Dhabaleshwar · Publicado 2023-12-22 · Atualizado 2024-05-17 · CVE-2023-7054

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPGurukul Online Notes Sharing System version 1.0

Description A problematic issue affects the processing of the file /user/add-notes.php, leading to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For PHPGurukul Online Notes Sharing System version 1.0, consider restricting access to the /user/add-notes.php file until a patch is available. As a temporary workaround, avoid using the file /user/add-notes.php for uploading notes to minimize the risk of exploitation.

Exploit

Correção

XSS

Unrestricted File Upload

Enumeração de Fraquezas

CWE-79

CWE-434

Identificadores relacionados

CVE-2023-7054

Produtos afetados

Phpgurukul Online Notes Sharing System

Referências · 7

• 🔥 https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/notes_malicious_fileupload.md · Exploit
• https://vuldb.com/?id.248741 · Nota
• https://t.me/cvenotify/65388 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-7054 · Nota de Segurança
• https://t.me/cvenotify/64823 · Publicação no Telegram
• https://vuldb.com/?ctiid.248741 · Nota
• https://osv.dev/vulnerability/CVE-2023-7054 · Aviso do Fabricante