PT-2024-13967 · Unknown · Online Notice Board System

Andres Roldan · CVE-2023-50760 · Published 2024-01-04 · Updated 2025-02-26

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Notice Board System version 1.0

Description The issue is related to an Insecure File Upload vulnerability. This vulnerability is located in the f parameter of the "user/update profile pic.php" page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.

Recommendations For Online Notice Board System version 1.0, consider disabling the file upload functionality on the "user/update profile pic.php" page until a patch is available. Restrict access to the f parameter to minimize the risk of exploitation. Avoid using the f parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-50760

Affected Products

Online Notice Board System

References · 10

• 🔥 https://fluidattacks.com/advisories/arrau · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-50760 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50760 · Vendor Advisory
• https://t.me/cvenotify/66210 · Telegram Post
• https://t.me/cibsecurity/74418 · Telegram Post
• https://kashipara.com · Note
• https://t.me/cvenotify/66251 · Telegram Post
• https://twitter.com/fluidattacks/status/1894538367192150092 · Twitter Post
• https://twitter.com/fluidattacks/status/1748122596690796934 · Twitter Post
• https://twitter.com/fluidattacks/status/1892639103558078726 · Twitter Post