PT-2025-51968 · Unknown · Projectsend

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-26 · CVE-2023-53930

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ProjectSend version r1605

Description An insecure direct object reference issue exists in ProjectSend r1605. An unauthenticated attacker can download private files by manipulating the id parameter in a download request to the 'process.php' endpoint. This allows access to any user's private files.

Recommendations Apply appropriate access controls to the 'process.php' endpoint to prevent unauthorized file downloads. Sanitize or validate the id parameter to ensure it corresponds to a legitimate file accessible to the requesting user.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-53930

Affected Products

Projectsend

References · 9

• 🔥 https://vulncheck.com/advisories/projectsend-insecure-direct-object-reference-file-download-vulnerability · Exploit
• 🔥 https://exploit-db.com/exploits/51400 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53930 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53930 · Security Note
• https://t.me/CVEtracker/40086 · Telegram Post
• https://t.me/cveNotify/146891 · Telegram Post
• https://twitter.com/CVEnew/status/2002487776152072590 · Twitter Post
• https://twitter.com/CveFindCom/status/2001437168808415716 · Twitter Post
• https://projectsend.org · Note