PHPOK unrestricted upload
CVE-2023-2888

4.7MEDIUM

Key Information:

Vendor

PHPok

Status
PHPok
Vendor
CVE Published:
25 May 2023

What is CVE-2023-2888?

A vulnerability in PHPOK version 6.4.100 permits unrestricted file uploads through the file handling process in /admin.php?c=upload&f=zip&_noCache=0.1683794968. This flaw enables remote attackers to upload potentially malicious files, leading to various security risks. As a result, users of this product must be vigilant in securing their installations to avoid exploitation.

Affected Version(s)

PHPOK 6.4.100

References

https://vuldb.com/?id.229953
vdb-entrytechnical-description
https://vuldb.com/?ctiid.229953
signaturepermissions-required
https://gitee.com/phpok/phpok/issues/I72D24
issue-tracking

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

VulDB Gitee Analyzer
.