A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543.
References
| Link | Resource |
|---|---|
| https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%202.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.230543 | Third Party Advisory |
| https://vuldb.com/?id.230543 | Third Party Advisory |
Configurations
History
09 Jun 2023, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Iuok
Iuok yfcmf-tp6 |
|
| CPE | cpe:2.3:a:iuok:yfcmf-tp6:*:*:*:*:*:*:*:* | |
| References | (MISC) https://github.com/HuBenLab/HuBenVulList/blob/main/YFCMF-TP6-3.0.4%20has%20a%20Remote%20Command%20Execution%20(RCE)%20vulnerability%202.md - Exploit, Third Party Advisory | |
| References | (MISC) https://vuldb.com/?id.230543 - Third Party Advisory | |
| References | (MISC) https://vuldb.com/?ctiid.230543 - Third Party Advisory |
02 Jun 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-02 13:15
Updated : 2024-04-11 01:21
NVD link : CVE-2023-3057
Mitre link : CVE-2023-3057
CVE.ORG link : CVE-2023-3057
JSON object : View
Products Affected
iuok
- yfcmf-tp6
CWE
CWE-24
Path Traversal: '../filedir'