Arbitrary File Upload Vulnerability in Purchase Order Management by Oretnom23
CVE-2023-29621

8.8HIGH

Key Information:

Vendor: Purchase Order Management Project
Status: Purchase Order Management
Vendor: CVE Published:; 14 April 2023

🔔 Create Purchase Order Management Project Vulnerability Alert

What is CVE-2023-29621?

Purchase Order Management v1.0 has a security weakness that permits attackers to upload arbitrary files. This vulnerability can lead to remote code execution on the server if malicious files are uploaded, posing a significant risk. Proper validation of file types and rigorous security controls are essential to mitigate this risk, as attackers can exploit this flaw to execute unwanted commands on the host system.

References

https://brightsec.com/blog/file-inclusion-vulnerabilities/

https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/mai...

CVSS V3.1

Score:

8.8

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 14, 2023
Vulnerability Reserved
Apr 7, 2023

CVE-2023-29621 Data

JSON