Vulnerability · Published Dec 17, 2023 · Assigned by VulDB

CVE-2023-6887saysky ForestBlog Image Upload img unrestricted upload

Medium 6.3

In plain English

A medium-severity unrestricted file upload in ForestBlog from saysky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.9%top 39.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the component Image Upload Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248247.

Affected products (as reported)

Vendor	Product	Versions
saysky	ForestBlog	20220630

Weakness: CWE-434 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.248247 vdb-entry, technical-description
https://vuldb.com/?ctiid.248247 signature, permissions-required
https://github.com/daydust/vuln/blob/main/ForestBlog/Arbitrary_File_Upload_Vulnerability.md exploit