PT-2023-29009 · Unknown · Prison Management System

Rootd4Ddy · Published 2023-10-04 · Updated 2023-10-07 · CVE-2023-43838

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Personal Management System version 1.4.64

Description The issue allows attackers to execute arbitrary code via uploading a crafted SVG file into a user profile's avatar.

Recommendations For Personal Management System version 1.4.64, consider disabling the file upload feature, specifically for SVG files, until a patch is available. Restrict access to the user profile's avatar upload functionality to minimize the risk of exploitation. Avoid using the file upload feature in user profiles until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-43838

Affected Products

Prison Management System

References · 10

• 🔥 https://github.com/rootd4ddy/CVE-2023-43838 · Exploit
• https://github.com/Volmarg/personal-management-system/blob/39d3c0df641a5435f2028b37a27d26ba61a3b97b/src/assets/scripts/core/ui/DataProcessor/SpecialAction.ts#L35 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43838 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43838 · Vendor Advisory
• https://github.com/Volmarg/personal-management-system · Note
• http://w3.org/2000/svg · Note
• https://twitter.com/IT_securitynews/status/1710598170986553808 · Twitter Post
• https://github.com/Volmarg · Note
• https://github.com/rootd4ddy · Note
• https://t.me/cibsecurity/71605 · Telegram Post