Ulearn a5a7ca20de859051ea0470542844980a66dfc05d - RCE
Summary
| Name | Ulearn a5a7ca20de859051ea0470542844980a66dfc05d - RCE |
| Code name | |
| Product | Ulearn |
| Affected versions | a5a7ca20de859051ea0470542844980a66dfc05d |
| State | Public |
| Release date | 2023-04-10 |
Vulnerability
| Kind | Insecure file upload |
| Rule | |
| Remote | Yes |
| CVSSv3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| CVSSv3.1 Base Score | 9.1 |
| Exploit available | No |
| CVE ID(s) |
Description
Ulearn version a5a7ca20de859051ea0470542844980a66dfc05d allows an attacker with administrator permissions to obtain remote code execution on the server through the image upload functionality. This occurs because the application does not validate that the uploaded image is actually an image.
Vulnerability
This vulnerability This occurs because the application does not validate that the uploaded image is actually an image.
Evidence of exploitation
To exploit this vulnerability, we only need to send the following malicious PHP code to the server.
Our security policy
We have reserved the ID CVE-2023-0670 to refer to this issue from now on.
System Information
-
Version: Ulearn a5a7ca20de859051ea0470542844980a66dfc05d
-
Operating System: GNU/Linux
Mitigation
There is currently no patch available for this vulnerability.
Credits
The vulnerability was discovered by Carlos Bello from Fluid Attacks' Offensive Team.
References
Vendor page https://github.com/ulearnpro/ulearn/
Timeline
2023-02-03
Vulnerability discovered.
2023-02-03
Vendor contacted.
2023-02-03
Vendor replied acknowledging the report.
2023-04-10
Public Disclosure.
