PT-2023-27305 · Unknown · Social Media Skeleton

Zodiac0704 · Published 2023-08-18 · Updated 2023-08-23 · CVE-2023-40173

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Social media skeleton versions prior to 1.0.5

Description The issue concerns a social media project implemented using php, css, javascript, and html. Prior to version 1.0.5, the project did not properly salt passwords, leaving user passwords susceptible to cracking should an attacker gain access to hashed passwords. This issue has been addressed in version 1.0.5.

Recommendations For versions prior to 1.0.5, upgrade to version 1.0.5 to address the issue. As a temporary workaround, consider implementing additional security measures to protect user passwords until the upgrade can be applied.

Exploit

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2023-40173

GHSA-RFMV-7M7G-V628

Affected Products

Social Media Skeleton

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40173.json · Exploit
• https://github.com/fobybus/social-media-skeleton/commit/344d798e82d6cc39844962c6d3cb2560f5907848 · Patch
• https://github.com/fobybus/social-media-skeleton/commit/df31da44ffed3ea065cbbadc3c8052d0d489a2ef · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-40173 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40173 · Vendor Advisory
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-rfmv-7m7g-v628 · Note
• https://t.me/cvenotify/56897 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1692700138962084141 · Twitter Post
• https://t.me/cibsecurity/68852 · Telegram Post
• https://twitter.com/CVEnew/status/1692661098070032686 · Twitter Post