Lucene search

Fluid AttacksCVELIST:CVE-2023-4122

HistoryDec 07, 2023 - 11:10 p.m.

CVE-2023-4122 Student Information System v1.0 - Insecure File Upload

2023-12-0723:10:04

CWE-434

Fluid Attacks

www.cve.org

cve-2023-4122

student information system

insecure file upload

my-profile page

remote code execution

authenticated attacker

server hosting the application

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

38.8%

JSON

Student Information System v1.0 is vulnerable to an Insecure File Upload vulnerability on the ‘photo’ parameter of my-profile page, allowing an authenticated attacker to obtain Remote Code Execution on the server hosting the application.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Student Information System",
    "vendor": "Kashipara Group",
    "versions": [
      {
        "status": "affected",
        "version": "1.0"
      }
    ]
  }
]

References

fluidattacks.com/advisories/rubinstein/

www.kashipara.com/

CVSS3

9.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

38.8%

JSON

Related for CVELIST:CVE-2023-4122