PT-2023-32855 · Unknown · Phpgurukul Online Notes Sharing System

Dhabaleshwar · Published 2023-12-22 · Updated 2024-05-17 · CVE-2023-7054

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PHPGurukul Online Notes Sharing System version 1.0

Description A problematic issue affects the processing of the file /user/add-notes.php, leading to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Recommendations For PHPGurukul Online Notes Sharing System version 1.0, consider restricting access to the /user/add-notes.php file until a patch is available. As a temporary workaround, avoid using the file /user/add-notes.php for uploading notes to minimize the risk of exploitation.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2023-7054

Affected Products

Phpgurukul Online Notes Sharing System

References · 7

• 🔥 https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/notes_malicious_fileupload.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-7054 · Security Note
• https://osv.dev/vulnerability/CVE-2023-7054 · Vendor Advisory
• https://vuldb.com/?id.248741 · Note
• https://t.me/cvenotify/65388 · Telegram Post
• https://t.me/cvenotify/64823 · Telegram Post
• https://vuldb.com/?ctiid.248741 · Note