PT-2019-13502 · Layerbb · Layerbb

Published 2019-07-19 · Updated 2019-07-19 · CVE-2019-13973

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LayerBB version 1.1.3

Description The issue allows for arbitrary file upload in the admin/general.php file due to the lack of restriction on the custom logo filename suffix, enabling the use of .php suffixes.

Recommendations For LayerBB version 1.1.3, restrict the custom logo filename suffix to prevent the use of .php extensions as a temporary workaround, and update to a newer version that addresses this issue once available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-13973

Affected Products

Layerbb

References · 3

• 🔥 http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elayerbb-1-1-3-xss%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13973 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13973 · Vendor Advisory