PT-2023-22353 · Extplorer · Extplorer

Published 2023-05-12 · Updated 2025-01-24 · CVE-2023-29657

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eXtplorer version 2.1.15

Description The issue allows for insecure permissions, specifically through the file upload feature in the file manager. This vulnerability enables the upload of zip files that contain PHP pages, which can lead to arbitrary code execution.

Recommendations For eXtplorer version 2.1.15, consider disabling the file upload feature in the file manager until a patch is available to prevent the upload of malicious zip files. Restrict access to the file manager to minimize the risk of exploitation. Avoid using the file upload feature for zip files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-29657

Affected Products

Extplorer

References · 10

• 🔥 http://blog.tristaomarinho.com/extplorer-2-1-15-arbitrary-file-upload · Exploit
• https://cve.org/CVERecord?id=CVE-2023-29657 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-29657 · Security Note
• https://ubuntu.com/security/CVE-2023-29657 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29657 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-29657 · Vendor Advisory
• http://extplorer.net · Note
• https://t.me/cibsecurity/63997 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29657 · Note
• https://t.me/cvenotify/108530 · Telegram Post