PT-2023-26497 · Openrapid · Openrapid Rapidcms

Txph · Published 2023-07-23 · Updated 2024-09-21 · CVE-2023-3852

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenRapid RapidCMS versions up to 1.3.1

Description A critical issue affects the file /admin/upload.php, where the manipulation of the file argument leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations To fix this issue, apply the patch with the name 4dff387283060961c362d50105ff8da8ea40bcbe. As a temporary workaround, consider restricting access to the /admin/upload.php file until the patch is applied. Avoid using the file argument in the affected file until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-3852

Affected Products

Openrapid Rapidcms

References · 9

• 🔥 https://github.com/OpenRapid/rapidcms/issues/1 · Exploit
• https://github.com/OpenRapid/rapidcms/commit/4dff387283060961c362d50105ff8da8ea40bcbe · Patch
• https://osv.dev/vulnerability/CVE-2023-3852 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3852 · Security Note
• https://twitter.com/rst_cloud/status/1837592534853263790 · Twitter Post
• https://vuldb.com/?id.235204 · Note
• https://t.me/cvenotify/54984 · Telegram Post
• https://vuldb.com/?ctiid.235204 · Note
• https://t.me/cibsecurity/67131 · Telegram Post