PT-2023-21018 · Jizhicms · Jizhicms

1Y0Ngo · Published 2023-03-15 · Updated 2023-03-20 · CVE-2023-27234

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Jizhicms version 2.4.5

Description A Cross-Site Request Forgery (CSRF) issue in the /Sys/index.html endpoint of the application allows attackers to make arbitrary configuration changes within the application. This can be exploited by attackers to modify settings without proper authorization.

Recommendations For Jizhicms version 2.4.5, as a temporary workaround, consider implementing additional validation for requests to the /Sys/index.html endpoint to prevent unauthorized configuration changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-27234

Affected Products

Jizhicms

References · 6

• 🔥 https://github.com/Cherry-toto/jizhicms/issues/85 · Exploit
• https://osv.dev/vulnerability/CVE-2023-27234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27234 · Security Note
• https://t.me/cvenotify/46529 · Telegram Post
• https://t.me/cvenotify/46191 · Telegram Post
• https://t.me/cibsecurity/60044 · Telegram Post