PT-2023-23492 · Unknown · Sourcecodester Online Computer/Laptop Store

Jadore147258369 · Published 2023-05-16 · Updated 2025-01-23 · CVE-2023-31857

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Computer and Laptop Store version 1.0

Description The issue allows unrestricted file upload, which can lead to remote code execution. The vulnerability path is "/classes/Users.php?f=save".

Recommendations For version 1.0, restrict access to the "/classes/Users.php?f=save" endpoint to minimize the risk of exploitation. Consider implementing proper file upload validation and sanitization to prevent malicious file uploads. As a temporary workaround, consider disabling the file upload functionality in the Users.php file until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-31857

Affected Products

Sourcecodester Online Computer/Laptop Store

References · 5

• 🔥 https://github.com/Jadore147258369/php-ocls/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-31857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31857 · Security Note
• https://t.me/cibsecurity/64210 · Telegram Post
• https://t.me/cvenotify/108366 · Telegram Post