CVE-2023-36118

概要

参考情報

• packetstormsecurity.com/files/172672/Faculty-Evaluation-System-1.0-Shell-Upload.html · Third Party Advisory
• Trinity-SYT-SECURITY/XSS_vuln_issue · Exploit
• hackmd.io/%40SY-T/Hy6HvwxPn · Broken Link
• chtsecurity.com/news/4ffbe017-70e1-4789-bfe6-4d6fb0d1a0b7 · Mitigation
• chtsecurity.com/news/5282e0af-7c45-43b0-9869-9becee7d6d70 · Third Party Advisory

faculty evaluation system のその他の脆弱性

• CVE-2023-33569高 7.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via ip/eval/ajax.php?action=update_user.
• CVE-2023-2962緊急 9.8A vulnerability, which was classified as critical, has been found in SourceCodester Faculty Evaluation System 1.0. Affected by this issue is…
• CVE-2023-33440高 7.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user.
• CVE-2023-33439高 7.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_task.php?id=.
• CVE-2023-31845高 7.2Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_class.php?id=.