PT-2023-29007 · Unknown · Super Store Finder

Published 2023-10-02 · Updated 2024-09-23 · CVE-2023-43835

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Super Store Finder versions 3.7 and below

Description The issue allows for authenticated Arbitrary PHP Code Injection, potentially leading to Remote Code Execution when settings overwrite config.inc.php content.

Recommendations For Super Store Finder versions 3.7 and below, update to a version above 3.7 to resolve the issue. As a temporary workaround, consider restricting access to the config.inc.php file to minimize the risk of exploitation. Avoid using the settings overwrite feature in the affected versions until the issue is resolved.

Exploit

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-43835

Affected Products

Super Store Finder

References · 6

• 🔥 https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-43835 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43835 · Vendor Advisory
• https://t.me/cibsecurity/71433 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1708977487965716691 · Twitter Post
• https://t.me/cvenotify/95697 · Telegram Post