by Kastro
Paper/Archive/CVE-2023-1722

CVE-2023-1722

Yoga Class Registration System Yoga Class Registration System — Yoga Class Registration System 1.0 - ATO

EPSS 0.4%public exploitCVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 30.2.302 × 206.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators.

Affected

ProductAffectedFixed inSource
Yoga Class Registration System1.0–CNA

Scores by source

Fluid Attacks (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

reffluidattacks.com/advisories/wyckoffrefsourcecodester.com/php/16097/yoga-class-registration-system-php-and-mysql-free-source-code.html