CVE-2023-6851 kalcaddle KodExplorer ZIP Archive app.php unzipList code injection

What is CVE-2023-6851?

CVE-2023-6851 is a medium-severity vulnerability in kalcaddle KodExplorer, published on 16 Dec 2023.

Official description

A vulnerability was found in kalcaddle KodExplorer up to 4.51.03. It has been rated as critical. This issue affects the function unzipList of the file plugins/zipView/app.php of the component ZIP Archive Handler. The manipulation leads to code injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 4.52.01 is able to address this issue. The patch is named 5cf233f7556b442100cf67b5e92d57ceabb126c6. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248219.

Weakness: CWE-94

Which versions are affected by CVE-2023-6851?

It affects 1 product.

Products include Kodcloud Kodexplorer.

How do I fix CVE-2023-6851?

No fix has been published for CVE-2023-6851 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-6851 being exploited?

There is no known exploitation of CVE-2023-6851 in the wild and no public exploit code.

Other vulnerabilities in kalcaddle KodExplorer

• CVE-2022-46154 Arbitrary file access in KodExplorer High 8.6
• CVE-2023-6850 kalcaddle KodExplorer API Endpoint unrestricted upload Medium 6.3
• CVE-2023-6852 kalcaddle KodExplorer app.php server-side request forgery Medium 6.3
• CVE-2023-6853 kalcaddle KodExplorer app.php index server-side request forgery Medium 6.3
• CVE-2023-49489 Cross-site scripting in n/a Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x29m-mj2r-hm54.