CVE-2023-2648 MEDIUM

CVE-2023-2648: Weaver E-Office uploadify.php unrestricted upload

Vendor Weaver
Product E-Office
Weakness CWE-434 · Unrestricted file upload
Published May 11, 2023
Last update January 24, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Key dates

02Disclosure timeline

May 11, 2023 CVE published
January 24, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-2744 SourceCodester Gym Management System Background Management add_exercises.php unrestricted upload CVE-2022-0950 Unrestricted Upload of File with Dangerous Type in star7th/showdoc CVE-2023-50386 Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets CVE-2023-5829 code-projects Admission Management System student_avatar.php unrestricted upload CVE-2026-39591 WordPress WP-BusinessDirectory plugin <= 4.0.0 - Arbitrary File Upload vulnerability