CVE-2023-5604 Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
Unauthenticated attackers can upload malicious files if forum administrators enable insecure settings, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5604?
CVE-2023-5604 is a critical vulnerability in Unknown Asgaros Forum, published on 27 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Asgaros Forum WordPress plugin before 2.7.1 allows forum administrators, who may not be WordPress (super-)administrators, to set insecure configuration that allows unauthenticated users to upload dangerous files (e.g. .php, .phtml), potentially leading to remote code execution.
Which versions are affected by CVE-2023-5604?
It affects 1 product.
Products include Asgaros Asgaros Forum.
How do I fix CVE-2023-5604?
No fix has been published for CVE-2023-5604 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5604 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-5604 exists.
Other vulnerabilities in Unknown Asgaros Forum
- CVE-2021-24827 Asgaros Forum < 1.15.13 - Unauthenticated SQL Injection
- CVE-2022-0411 Asgaros Forum < 2.0.0 - Subscriber+ Blind SQL Injection
- CVE-2024-22284 WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection
- CVE-2021-25045 Asgaros Forum < 1.15.15 - Admin+ SQL Injection via forum_id
- CVE-2022-41608 WordPress Asgaros Forum Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)
Sources
Also known as GHSA-7862-qcxg-7h4c.