PT-2022-10755 · Softvibe · Softvibe Saraban For Infoma

Published 2022-01-18 · Updated 2024-02-14 · CVE-2021-38697

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SoftVibe SARABAN for INFOMA version 1.1

Description The issue allows unauthenticated unrestricted file upload, enabling attackers to upload files with any file extension, which can lead to arbitrary code execution.

Recommendations For SoftVibe SARABAN for INFOMA version 1.1, consider restricting file upload capabilities to authenticated users and validating file extensions to prevent malicious uploads until a patch is available. As a temporary workaround, restrict access to the file upload feature to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-38697

Affected Products

Softvibe Saraban For Infoma

References · 8

• 🔥 https://orangeo.tech/post/2021/12/24/First-CVEs.html · Exploit
• 🔥 https://sawatdee.github.io/post/2021/12/24/First-CVEs.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-38697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38697 · Security Note
• https://t.me/cibsecurity/35698 · Telegram Post
• https://t.me/cvenotify/25588 · Telegram Post
• http://infoma.net/index.php/saraban · Note
• https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US · Note