CVE-2023-0963 SourceCodester Music Gallery Site POST Request Users.php access control

High 7.3 Published 22 Feb 2023 Updated 25 Nov 2024

Remote attackers can bypass access controls in the Users.php handler to perform unauthorized actions, requiring immediate attention from site administrators.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-0963?

CVE-2023-0963 is a high-severity missing authorization vulnerability in SourceCodester Music Gallery Site, published on 22 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-221633 was assigned to this vulnerability.

Weakness: CWE-284

Which versions are affected by CVE-2023-0963?

It affects 1 product.

Products include Music Gallery Site Project Music Gallery Site.

How do I fix CVE-2023-0963?

No fix has been published for CVE-2023-0963 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-0963 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0963 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-77pv-69c3-pjgf.