by Kastro
Paper/Archive/CVE-2023-53980

CVE-2023-53980

ProjectSend projectSend — ProjectSend r1605 Remote Code Execution via File Extension Manipulation

EPSS 0.9%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.1.611 × 2012.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by manipulating file extensions. Attackers can upload shell scripts with disguised extensions through the upload.process.php endpoint to execute arbitrary commands on the server.

Affected

ProductAffectedFixed inSource
projectSendr1605–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitexploit-db.com/exploits/51238refprojectsend.orgwriteupvulncheck.com/advisories/projectsend-remote-code-execution-via-file-extension-manipulation