PT-2023-31918 · Unknown · Resumable.Php

Williamdes · Published 2023-12-26 · Updated 2024-01-04 · CVE-2023-52086

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions resumable.php versions 0.1.4 through 3c6dbf5

Description The issue allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. It is noted that file overwrite has not been possible with the code available in GitHub in recent years.

Recommendations For versions 0.1.4 through 3c6dbf5, consider disabling the upload.php script until a patch is available to prevent arbitrary file uploads. Restrict access to the upload.php endpoint to minimize the risk of exploitation. Avoid using the ../ path traversal in the multipart/form-data content to prevent uploading files to unintended locations.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-52086

Affected Products

Resumable.Php

References · 10

• https://github.com/dilab/resumable.php/pull/39/commits/408f54dff10e48befa44d417933787232a64304b · Patch
• https://github.com/dilab/resumable.php/pull/27/commits/3e3c94d0302bb399a7611b4738a5a4dd0832a926 · Patch
• https://github.com/dilab/resumable.php/commit/3c6dbf5170b01cbb712013c7d0a83f5aac45653b · Patch
• https://github.com/dilab/resumable.php/pull/39/commits/d3552efd403e2d87407934477eee642836cab3b4 · Patch
• https://osv.dev/vulnerability/CVE-2023-52086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52086 · Security Note
• https://github.com/dilab/resumable.php/issues/34 · Note
• https://t.me/cvenotify/66153 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1739735754673143981 · Twitter Post
• https://twitter.com/CVEnew/status/1739712324259168461 · Twitter Post