CVE-2023-7147 gopeak MasterLab User.php base64ImageContent unrestricted upload
Remote attackers can upload malicious files via the base64ImageContent function in gopeak MasterLab, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7147?
CVE-2023-7147 is a medium-severity vulnerability in gopeak MasterLab, published on 29 Dec 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.
Weakness: CWE-434
Which versions are affected by CVE-2023-7147?
It affects 1 product.
Products include Masterlab Masterlab.
How do I fix CVE-2023-7147?
No fix has been published for CVE-2023-7147 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-7147 being exploited?
There is no known exploitation of CVE-2023-7147 in the wild and no public exploit code.
Other vulnerabilities in gopeak MasterLab
- CVE-2020-23534 Server-side request forgery in n/a
- CVE-2023-7144 gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection
- CVE-2023-7145 gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection
- CVE-2023-7146 gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection
- CVE-2023-7159 gopeak MasterLab User.php update unrestricted upload
Sources
Also known as GHSA-7cfv-8gr7-hvw3.