Unrestricted Upload Vulnerability in DeDeCMS Backend Component
CVE-2023-7212
4.7MEDIUM
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2023-7212?
A vulnerability has been identified in DeDeCMS that allows for unrestricted file uploads via the file_class.php component of its Backend. This issue can be exploited remotely, potentially allowing attackers to upload malicious files to the server. Given that the exploit has already been publicly disclosed, urgency is required in addressing this vulnerability to prevent unwanted access and potential damage to the web application and its users.
Affected Version(s)
DeDeCMS 5.7.112
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
CVSS V3.0
Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published