PT-2023-7880 · Kaifa Technology · Webitr

Cyku · Published 2023-12-15 · Updated 2024-10-14 · CVE-2023-48392

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kaifa Technology WebITR (affected versions not specified)

Description The issue is related to the use of a hard-coded encryption key in the WebITR online attendance system. This allows an unauthenticated remote attacker to generate a valid token parameter and exploit the vulnerability to access the system with an arbitrary user account, including the administrator's account. The attacker can then execute the login account's permissions and obtain relevant information. The vulnerability can be exploited to elevate privileges to the level of an administrator.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

BDU:2023-08951

CVE-2023-48392

Affected Products

Webitr

References · 10

• https://bdu.fstec.ru/vul/2023-08951 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-48392 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48392 · Vendor Advisory
• https://twitter.com/CVEnew/status/1735592367464309069 · Twitter Post
• https://twcert.org.tw/tw/cp-132-7622-57e5f-1.html · Note
• https://t.me/cvenotify/64898 · Telegram Post
• https://debricked.com/vulnerability-database/vulnerability/CVE-2023-48392 · Note
• https://vuldb.com/fr/?id.248150 · Note
• https://twitter.com/VulmonFeeds/status/1735624217368940768 · Twitter Post
• https://github.com/advisories/GHSA-wv9r-p2rc-jcrp · Note