Headline
CVE-2023-0670: Ulearn a5a7ca20de859051ea0470542844980a66dfc05d - RCE | Advisories | Fluid Attacks
Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not validate that the uploaded image is actually an image.
Summary
Name
Ulearn a5a7ca20de859051ea0470542844980a66dfc05d - RCE
Code name
Scott
Product
Ulearn
Affected versions
a5a7ca20de859051ea0470542844980a66dfc05d
State
Public
Release Date
2023-04-10
Vulnerability
Kind
Insecure file upload
Rule
027. Insecure file upload
Remote
Yes
CVSSv3 Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSSv3 Base Score
9.1
Exploit available
No
CVE ID(s)
CVE-2023-0670
Description
Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not validate that the uploaded image is actually an image.
Vulnerability
This vulnerability This occurs because the application does not validate that the uploaded image is actually an image.
Evidence of exploitation
To exploit this vulnerability, we only need to send the following malicious PHP code to the server.
Our security policy
We have reserved the ID CVE-2023-0670 to refer to this issue from now on.
- https://fluidattacks.com/advisories/policy/
System Information
Version: Ulearn a5a7ca20de859051ea0470542844980a66dfc05d
Operating System: GNU/Linux
Mitigation
There is currently no patch available for this vulnerability.
Credits
The vulnerability was discovered by Carlos Bello from Fluid Attacks’ Offensive Team.
References
Vendor page https://github.com/ulearnpro/ulearn/
Timeline
2023-02-03
Vulnerability discovered.
2023-02-03
Vendor contacted.
2023-02-03
Vendor replied acknowledging the report.
2023-04-10
Public Disclosure.