CVE-2023-53933

Summary

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.

Affected Software

Weaknesses

• CWE-434: Unrestricted Upload of File with Dangerous Type

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: total

Additional References

• https://www.exploit-db.com/exploits/51372

References

• https://www.exploit-db.com/exploits/51372
• https://docs.s9y.org/
• https://www.vulncheck.com/advisories/serendipity-authenticated-remote-code-execution-via-file-upload

• ←Previous
• Next→