A vulnerability, which was classified as critical, has been found in SourceCodester Engineers Online Portal 1.0. This issue affects some unknown processing of the file student_avatar.php. The manipulation of the argument change leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-240905 was assigned to this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf | Exploit |
| https://vuldb.com/?ctiid.240905 | Permissions Required Third Party Advisory VDB Entry |
| https://vuldb.com/?id.240905 | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
02 Oct 2023, 18:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://vuldb.com/?id.240905 - Third Party Advisory, VDB Entry | |
| References | (MISC) https://github.com/llixixi/Engineers-Online-Portal-System/blob/main/Engineers%20Online%20Portal%20System%20has%20a%20file%20upload%20(RCE)%20vulnerability.pdf - Exploit | |
| References | (MISC) https://vuldb.com/?ctiid.240905 - Permissions Required, Third Party Advisory, VDB Entry | |
| First Time |
Engineers Online Portal Project
Engineers Online Portal Project engineers Online Portal |
|
| CPE | cpe:2.3:a:engineers_online_portal_project:engineers_online_portal:1.0:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
29 Sep 2023, 18:22
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-29 18:15
Updated : 2024-05-14 14:25
NVD link : CVE-2023-5277
Mitre link : CVE-2023-5277
CVE.ORG link : CVE-2023-5277
JSON object : View
Products Affected
engineers_online_portal_project
- engineers_online_portal
CWE
CWE-434
Unrestricted Upload of File with Dangerous Type