CVE-2023-52154 File upload in n/a

High 7.2 Published 21 Feb 2024 Updated 29 Aug 2024

Attackers can execute arbitrary code by uploading crafted PHTML files to the camera upload feature in PMB library software.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-52154?

CVE-2023-52154 is a high-severity vulnerability in n/a, published on 21 Feb 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHTML files.

Weakness: CWE-434

Which versions are affected by CVE-2023-52154?

It affects 1 product.

Products include Sigb Pmb.

How do I fix CVE-2023-52154?

No fix has been published for CVE-2023-52154 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-52154 being exploited?

There is no known exploitation of CVE-2023-52154 in the wild and no public exploit code.

Sources

Also known as GHSA-5mmq-q62j-mv27.