CVE-2023-46865 - Vulnerability Details - OpenCVE

ReportizFlow

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Craterapp	Crater

Configuration 1 [-]

cpe:2.3:a:craterapp:crater:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/asylumdx/Crater-CVE-2023-46865-RCE
https://github.com/crater-invoice/crater/issues/1267
https://github.com/crater-invoice/crater/pull/1271
https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater-invoice.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-10-30T00:00:00

Updated: 2024-08-02T20:53:21.808Z

Reserved: 2023-10-30T00:00:00

Link: CVE-2023-46865

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-10-30T01:15:21.967

Modified: 2024-11-21T08:29:26.930

Link: CVE-2023-46865

Redhat

No data.

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:craterapp:crater:*:*:*:*:*:*:*:*", "matchCriteriaId": "3D402EFB-A3FF-49C9-81E8-EF904A46277E", "versionEndIncluding": "6.0.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image."}, {"lang": "es", "value": "/api/v1/company/upload-logo en CompanyController.php en crater hasta 6.0.6 permite a un superadministrador ejecutar c\u00f3digo PHP arbitrario colocando este c\u00f3digo en un fragmento IDAT image/png de una imagen del Logotipo de la Empresa."}], "id": "CVE-2023-46865", "lastModified": "2024-11-21T08:29:26.930", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-10-30T01:15:21.967", "references": [{"source": "[email protected]", "url": "https://github.com/asylumdx/Crater-CVE-2023-46865-RCE"}, {"source": "[email protected]", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/crater-invoice/crater/issues/1267"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/crater-invoice/crater/pull/1271"}, {"source": "[email protected]", "url": "https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater-invoice.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/asylumdx/Crater-CVE-2023-46865-RCE"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://github.com/crater-invoice/crater/issues/1267"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/crater-invoice/crater/pull/1271"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://notes.netbytesec.com/2023/11/post-auth-rce-in-crater-invoice.html"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "[email protected]", "type": "Primary"}]}