CVE-2023-6099 Shenzhen Youkate Industrial Facial Love Cloud Payment System Account SystemMng.ashx privileges management
Attackers can escalate privileges by manipulating the operatorRole argument in the Account Handler, requiring vendor attention for mitigation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6099?
CVE-2023-6099 is a high-severity vulnerability in Shenzhen Youkate Industrial Facial Love Cloud Payment System, published on 13 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unknown part of the file /SystemMng.ashx of the component Account Handler. The manipulation of the argument operatorRole with the input 00 leads to improper privilege management. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245061 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Weakness: CWE-269
Which versions are affected by CVE-2023-6099?
It affects 1 product.
Products include Szjocat Facial Love Cloud Platform.
How do I fix CVE-2023-6099?
No fix has been published for CVE-2023-6099 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-6099 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-6099 exists.
Sources
Also known as GHSA-78f7-85pv-v66m.