by Kastro
Paper/Archive/CVE-2023-48371

CVE-2023-48371

ITPison OMICARD EDM 's SMS — ITPison OMICARD EDM 's SMS - Arbitrary File Upload

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.6.616 × 2012.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

ITPison OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service.

Affected

ProductAffectedFixed inSource
OMICARD EDM 's SMSv6.0.1.5–CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftwcert.org.tw/tw/cp-132-7590-55002-1.html