CVE-2023-38947
03.08.2023, 16:15
An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code via a crafted PHP file.
| Vendor | Product | Version |
|---|---|---|
| wbce | wbce_cms | 1.6.1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-434 - Unrestricted Upload of File with Dangerous TypeThe software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
- CWE-616 - Incomplete Identification of Uploaded File Variables (PHP)The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
References