PT-2025-51968 · Unknown · Projectsend

Mirabbas Ağalarov · Publicado 2025-12-17 · Atualizado 2025-12-26 · CVE-2023-53930

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjectSend version r1605

Description An insecure direct object reference issue exists in ProjectSend r1605. An unauthenticated attacker can download private files by manipulating the id parameter in a download request to the 'process.php' endpoint. This allows access to any user's private files.

Recommendations Apply appropriate access controls to the 'process.php' endpoint to prevent unauthorized file downloads. Sanitize or validate the id parameter to ensure it corresponds to a legitimate file accessible to the requesting user.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-53930

Produtos afetados

Projectsend

Referências · 9

• 🔥 https://vulncheck.com/advisories/projectsend-insecure-direct-object-reference-file-download-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/51400 · Exploit
• https://t.me/CVEtracker/40086 · Publicação no Telegram
• https://t.me/cveNotify/146891 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-53930 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2002487776152072590 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-53930 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2001437168808415716 · Publicação no Twitter
• https://projectsend.org · Nota