CVE-2023-33253

2023-06-1200:00:00

mitre

www.cve.org

labcollector

remote code execution

insufficient validation

AI Score

9.3

Confidence

High

EPSS

0.006

Percentile

79.2%

JSON

LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an executable PHP file and execute system commands. The vulnerability is in the message function, and is due to insufficient validation of the file (such as shell.jpg.php.shell) being sent.