PT-2024-13658 · Unknown · Tramyardg Autoexpress

Published 2024-03-21 · Updated 2024-08-08 · CVE-2023-48902

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tramyardg autoexpress version 1.3.0

Description An issue in tramyardg autoexpress allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in the "uploadCarImages.php" file.

Recommendations For tramyardg autoexpress version 1.3.0, ensure strict user authentication to prevent unauthorized access, and review the system for potential patches as soon as possible. As a temporary workaround, consider restricting access to the "uploadCarImages.php" file until a patch is available.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-48902

Affected Products

Tramyardg Autoexpress

References · 5

• 🔥 https://packetstormsecurity.com/files/177661/Tramyardg-Autoexpress-1.3.0-Authentication-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2023-48902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48902 · Security Note
• https://twitter.com/oktsec/status/1771628428774531382 · Twitter Post
• https://t.me/cvenotify/89988 · Telegram Post