by Kastro
Paper/Archive/CVE-2023-6907

CVE-2023-6907

codelyfe Stupid Simple CMS — codelyfe Stupid Simple CMS Deletion Interface delete.php improper authentication

EPSS 1%CVSS 9.1
critical.is priorityof 100
41
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 68.2.682 × 2013.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A vulnerability has been found in codelyfe Stupid Simple CMS up to 1.2.4 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /file-manager/delete.php of the component Deletion Interface. The manipulation of the argument file leads to improper authentication. The exploit has been disclosed to the public and may be used. The identifier VDB-248269 was assigned to this vulnerability.

Affected

ProductAffectedFixed inSource
Stupid Simple CMS1.2.0–CNA
Stupid Simple CMS1.2.1–CNA
Stupid Simple CMS1.2.2–CNA
Stupid Simple CMS1.2.3–CNA
Stupid Simple CMS1.2.4–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulDB (CNA)5.4CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
VulDB (CNA)5.4CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

writeupvuldb.com/?id.248269refvuldb.com/?ctiid.248269exploitgithub.com/g1an123/POC/blob/main/Unauthorized%20file%20deletion.md