Weaver E-Office unrestricted upload
CVE-2023-2523

9.8CRITICAL

Key Information:

Vendor: Weaver
Status: E-Office
Vendor: CVE Published:; 4 May 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 91%📰 News Worthy

What is CVE-2023-2523?

A vulnerability within Weaver E-Office 9.5 was identified in the App/Ajax/ajax.php file, specifically in the mobile_upload_save functionality. This issue enables an attacker to manipulate the 'upload_quwan' argument, resulting in unrestricted file uploads. Such vulnerabilities can lead to serious security risks, allowing attackers to upload malicious files to the server, potentially compromising the entire system. It has been publicly disclosed, and the lack of response from the vendor raises concerns about its mitigation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

E-Office 9.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-2523
Created by Any3ite