PT-2023-17005 · Sourcecodester · Sourcecodester Student Study Center Desk Management System

Wwesleywww · Published 2023-03-17 · Updated 2024-09-07 · CVE-2023-1467

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Student Study Center Desk Management System version 1.0

Description A critical vulnerability has been found in the SourceCodester Student Study Center Desk Management System. The issue affects an unknown function of the file Master.php, specifically the f=delete img component of the POST Parameter Handler. The manipulation of the path argument with the input C%3A%2Ffoo.txt leads to path traversal. This can be exploited remotely. The exploit has been disclosed to the public.

Recommendations For version 1.0, as a temporary workaround, consider restricting access to the Master.php?f=delete img endpoint until a patch is available. Avoid using the path argument in the affected POST Parameter Handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-1467

Affected Products

Sourcecodester Student Study Center Desk Management System

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-1467 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1467 · Vendor Advisory
• https://vuldb.com/?ctiid.223326 · Note
• https://t.me/cvenotify/46383 · Telegram Post
• https://t.me/cibsecurity/60248 · Telegram Post
• https://vuldb.com/?id.223326 · Note
• https://t.me/cvenotify/72628 · Telegram Post