PT-2023-20048 · Unknown · Cleverstupiddog Yf-Exam

Cleverstupiddog · Published 2023-03-03 · Updated 2023-03-10 · CVE-2023-25402

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CleverStupidDog yf-exam version 1.8.0

Description The issue concerns a lack of restriction on the suffix of uploaded files, allowing any file to be uploaded.

Recommendations For version 1.8.0, restrict access to the file upload feature until a proper fix is implemented to validate and restrict file types based on their suffix. As a temporary workaround, consider implementing server-side checks to only allow specific, safe file extensions to be uploaded.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-25402

Affected Products

Cleverstupiddog Yf-Exam

References · 5

• 🔥 https://github.com/CleverStupidDog/yf-exam/issues/1 · Exploit
• 🔥 https://github.com/Fw-fW-fw/UPDATE-CVE/blob/main/CVE-2023-25402 · Exploit
• https://osv.dev/vulnerability/CVE-2023-25402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25402 · Security Note
• https://t.me/cibsecurity/59418 · Telegram Post