PT-2024-19465 · Unknown · Qiyu Ifair

Published 2024-01-30 · Updated 2024-02-05 · CVE-2024-22523

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Qiyu iFair versions 23.8 ad0 and earlier

Description The issue allows remote attackers to obtain sensitive information via the uploadimage component. This is a Directory Traversal vulnerability, which means that attackers can access files and directories that are outside the intended directory structure.

Recommendations For Qiyu iFair versions 23.8 ad0 and earlier, consider restricting access to the uploadimage component until a patch is available. As a temporary workaround, limit the ability of remote attackers to upload files and obtain sensitive information. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-22523

Affected Products

Qiyu Ifair

References · 5

• 🔥 https://yuque.com/for82/vdzwqe/sc8ictw8poo8v5gl · Exploit
• https://osv.dev/vulnerability/CVE-2024-22523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22523 · Security Note
• https://twitter.com/VulmonFeeds/status/1752296627425997207 · Twitter Post
• https://t.me/cvenotify/70082 · Telegram Post