CVE-2023-28731

Summary

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected.

This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected Software

Weaknesses

• CWE-20: CWE-20 Improper Input Validation
• CWE-434: CWE-434 Unrestricted Upload of File with Dangerous Type

Workarounds

Prevent the execution of PHP files in the thumbnail directory to prevent the injected code from being executed

ADP Enrichment

CVE Program Container

Additional References

• https://www.acymailing.com/change-log/
• https://www.bugbounty.ch/advisories/CVE-2023-28731

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• https://www.acymailing.com/change-log/
• https://www.bugbounty.ch/advisories/CVE-2023-28731

• ←Previous
• Next→