PT-2023-29788 · Sourcecodester · Sourcecodester Best Courier Management System

Zerrr0 · Published 2023-10-18 · Updated 2023-10-25 · CVE-2023-46004

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Best Courier Management System version 1.0

Description The issue concerns an arbitrary file upload vulnerability in the update user function. This allows for potential malicious file uploads. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For Sourcecodester Best Courier Management System version 1.0, consider disabling the update user function until a patch is available to prevent arbitrary file uploads. Restrict access to file upload features to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-46004

Affected Products

Sourcecodester Best Courier Management System

References · 7

• 🔥 https://github.com/zerrr0/Zerrr0_Vulnerability/blob/main/Best%20Courier%20Management%20System%201.0/Arbitrary-File-Upload-Vulnerability.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-46004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46004 · Security Note
• https://t.me/cvenotify/59673 · Telegram Post
• https://t.me/latest_high_impact_cve/46 · Telegram Post
• https://twitter.com/IT_securitynews/status/1716387201787785609 · Twitter Post
• https://t.me/cibsecurity/72518 · Telegram Post