CVE-2023-48031 File upload in n/a
Attackers can upload malicious .bat files by spoofing magic bytes in OpenSupports, enabling arbitrary code execution and system control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48031?
CVE-2023-48031 is a critical vulnerability in n/a, published on 17 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation.
Weakness: CWE-434
Which versions are affected by CVE-2023-48031?
It affects 1 product.
Products include Opensupports Opensupports.
How do I fix CVE-2023-48031?
No fix has been published for CVE-2023-48031 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-48031 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-48031 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-c74v-c978-ww7p.