PT-2023-25046 · Cmseasy · Cmseasy

Published 2023-06-15 · Updated 2023-06-26 · CVE-2023-34880

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cmseasy version 7.7.7.7

Description A path traversal issue was discovered, allowing attackers to execute arbitrary code and perform local file inclusion via the add action method at lib/admin/language admin.php.

Recommendations For version 7.7.7.7, consider restricting access to the add action method in lib/admin/language admin.php to minimize the risk of exploitation until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-34880

Affected Products

Cmseasy

References · 3

• 🔥 https://blog.pumpk1n.com/2023/06/06/cmseasy-v7-7-7-7-20230520-path-traversal · Exploit
• https://osv.dev/vulnerability/CVE-2023-34880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34880 · Security Note