PT-2023-17190 · Unknown · Yoga Class Registration System

Carlos Bello · Published 2023-06-23 · Updated 2023-09-21 · CVE-2023-1721

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yoga Class Registration System version 1.0

Description The issue allows an administrator to execute commands on the server due to the application's failure to correctly validate the thumbnails of the classes uploaded by the administrators.

Recommendations For Yoga Class Registration System version 1.0, consider disabling the thumbnail upload feature for administrators until a patch is available to prevent potential command execution on the server. Restrict access to the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-1721

Affected Products

Yoga Class Registration System

References · 7

• 🔥 https://fluidattacks.com/advisories/blessd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-1721 · Security Note
• https://osv.dev/vulnerability/CVE-2023-1721 · Vendor Advisory
• https://twitter.com/fluidattacks/status/1705001460033876237 · Twitter Post
• https://t.me/cvenotify/52998 · Telegram Post
• https://sourcecodester.com/php/16097/yoga-class-registration-system-php-and-mysql-free-source-code.html · Note
• https://t.me/cibsecurity/65491 · Telegram Post