PT-2023-32513 · Shenzhen Youkate Industrial · Shenzhen Youkate Industrial Facial Love Cloud Payment System

Gatsby · Published 2023-11-13 · Updated 2024-05-17 · CVE-2023-6099

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shenzhen Youkate Industrial Facial Love Cloud Payment System versions up to 1.0.55.0.0.1

Description A critical vulnerability has been found in the Shenzhen Youkate Industrial Facial Love Cloud Payment System. This issue affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the operatorRole argument with the input 00 leads to improper privilege management. It is possible to initiate the attack remotely.

Recommendations For Shenzhen Youkate Industrial Facial Love Cloud Payment System versions up to 1.0.55.0.0.1, as a temporary workaround, consider restricting access to the /SystemMng.ashx file until a patch is available. Additionally, avoid using the operatorRole argument with the input 00 in the affected component Account Handler to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-6099

Affected Products

Shenzhen Youkate Industrial Facial Love Cloud Payment System

References · 6

• 🔥 https://github.com/gatsby2003/Shenzhen-Youkate-Industrial-Co.-Ltd/blob/main/Shenzhen%20Youkate%20Industrial%20Co.%2C%20Ltd.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-6099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6099 · Security Note
• https://t.me/cvenotify/60639 · Telegram Post
• https://vuldb.com/?id.245061 · Note
• https://vuldb.com/?ctiid.245061 · Note