PT-2023-31029 · Unknown+1 · Phpsysinfo+1

Namiltd · Published 2023-12-19 · Updated 2024-01-02 · CVE-2023-49006

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Phpsysinfo version 3.4.3

Description A Cross Site Request Forgery (CSRF) issue allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. The functionality is disabled by default in Phpsysinfo 3.4.3, but users may enable the vulnerable functionality.

Recommendations For Phpsysinfo version 3.4.3, consider disabling the vulnerable functionality related to the XML.php file until a patch is available. As a temporary workaround, restrict access to the XML.php file to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-49006

GHSA-67GV-XRW7-P72W

Affected Products

Debian

Phpsysinfo

References · 17

• 🔥 https://github.com/Hebing123/cve/issues/5 · Exploit
• 🔥 https://huntr.com/bounties/ca6d669f-fd82-4188-aae2-69e08740d982 · Exploit
• https://github.com/phpsysinfo/phpsysinfo/commit/4f2cee505e4f2e9b369a321063ff2c5e0c34ba45 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-49006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49006 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-49006 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-49006 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-49006 · Security Note
• https://osv.dev/vulnerability/GHSA-67gv-xrw7-p72w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-49006 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-49006 · Vendor Advisory
• https://github.com/phpsysinfo/phpsysinfo · Note
• https://twitter.com/CVEnew/status/1737041804355133498 · Twitter Post
• https://t.me/cvenotify/65941 · Telegram Post
• https://t.me/cvenotify/64108 · Telegram Post