CVE-2023-48394 Kaifa Technology WebITR - Arbitrary File Upload
Remote attackers with regular user privileges can upload arbitrary files to execute commands or disrupt service in Kaifa Technology WebITR.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-48394?
CVE-2023-48394 is a high-severity vulnerability in Kaifa Technology WebITR, published on 15 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kaifa Technology WebITR is an online attendance system, its file uploading function does not restrict upload of file with dangerous type. A remote attacker with regular user privilege can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service.
Weakness: CWE-434
Which versions are affected by CVE-2023-48394?
It affects 1 product.
Products include Kaifa Webitr Attendance System.
How do I fix CVE-2023-48394?
No fix has been published for CVE-2023-48394 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-48394 being exploited?
There is no known exploitation of CVE-2023-48394 in the wild and no public exploit code.
Other vulnerabilities in Kaifa Technology WebITR
Sources
Also known as GHSA-j8v2-m2f3-8jgf.