PT-2023-8937 · Outdoorbits · Little-Backup-Box

CVE-2023-52262 · Published 2023-12-30 · Updated 2024-01-09

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions outdoorbits little-backup-box versions prior to f39f91c

Description The issue allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input. This is due to insufficient validation of input data.

Recommendations For versions prior to f39f91c, update to a version after f39f91c to resolve the issue. As a temporary workaround, consider disabling the use of the PHP extract function for untrusted input until a patch is available. Restrict access to the affected software to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

BDU:2024-02733

CVE-2023-52262

Affected Products

Little-Backup-Box

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52262.json · Exploit
• https://github.com/outdoorbits/little-backup-box/commit/f39f91cd05544b3eb18b59897c765d6ba9313faa · Patch
• https://bdu.fstec.ru/vul/2024-02733 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52262 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52262 · Security Note
• https://github.com/advisories/GHSA-rq2j-cfp8-w8c7 · Note
• https://vuldb.com/de/?id.249396 · Note
• https://t.me/cibsecurity/74043 · Telegram Post
• https://twitter.com/Esparta6108713/status/1741502110573961571 · Twitter Post
• https://twitter.com/CVEnew/status/1741170371598954860 · Twitter Post
• https://php.net/manual/ru/function.extract.php · Note
• https://t.me/cvenotify/65813 · Telegram Post
• https://php.net/manual/en/function.extract · Note
• https://t.me/cvenotify/66827 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1741209619383333302 · Twitter Post