PT-2023-25764 · Travianz · Travianz

Bram · Published 2023-07-07 · Updated 2023-07-13 · CVE-2023-36992

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TravianZ versions 8.3.3 through 8.3.4

Description The issue allows remote attackers to execute PHP code through PHP injection in the config editor on the admin page.

Recommendations For versions 8.3.3 and 8.3.4, consider disabling the config editor in the admin page until a patch is available. Restrict access to the admin page to minimize the risk of exploitation. Avoid using the config editor feature in the affected versions until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-36992

Affected Products

Travianz

References · 4

• 🔥 https://bramdoessecurity.com/travianz-hacked · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36992 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36992 · Vendor Advisory
• https://t.me/cibsecurity/66224 · Telegram Post