CVE-2023-6887 - saysky ForestBlog Image Upload img unrestricted upload

Back Back to CVE browser

CRITICAL

saysky ForestBlog Image Upload img unrestricted upload

Published Dec 17, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 0.91%

Description

A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the component Image Upload Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248247.

Affected products

Vendor Saysky Product ForestBlog Default
n/a
- Version
  20220630
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Saysky

ForestBlog

n/a

Version	Status	Constraints
20220630	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59090
Advisory
https://github.com/daydust/vuln/blob/main/ForestBlog/Arbitrary_File_Upload_Vulnerability.md
exploitThird Party Advisory
https://vuldb.com/?ctiid.248247
signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.248247
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59090		Advisory
https://github.com/daydust/vuln/blob/main/ForestBlog/Arbitrary_File_Upload_Vulnerability.md		exploitThird Party Advisory
https://vuldb.com/?ctiid.248247		signaturepermissions-requiredPermissions Required
https://vuldb.com/?id.248247		vdb-entrytechnical-descriptionThird Party Advisory