CVE-2023-7159 gopeak MasterLab User.php update unrestricted upload
Remote attackers can upload malicious files via the avatar parameter in the admin user update function, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-7159?
CVE-2023-7159 is a medium-severity vulnerability in gopeak MasterLab, published on 29 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.
Weakness: CWE-434
Which versions are affected by CVE-2023-7159?
It affects 1 product.
Products include Masterlab Masterlab.
How do I fix CVE-2023-7159?
No fix has been published for CVE-2023-7159 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-7159 being exploited?
There is no known exploitation of CVE-2023-7159 in the wild and no public exploit code.
Other vulnerabilities in gopeak MasterLab
- CVE-2020-23534 Server-side request forgery in n/a
- CVE-2023-7144 gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection
- CVE-2023-7145 gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection
- CVE-2023-7146 gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection
- CVE-2023-7147 gopeak MasterLab User.php base64ImageContent unrestricted upload
Sources
Also known as GHSA-cpj9-wvvx-v589.