CVE-2023-48031

2023-11-1700:00:00

mitre

github.com

opensupports v4.11.0

unrestricted upload

dangerous type

file upload

security restrictions

arbitrary code

reverse shell

unauthorized file writes

crafted file upload

AI Score

7.8

Confidence

Low

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file’s magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim’s station via a crafted file upload operation.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:opensupports:opensupports:4.11.0:*:*:*:*:*:*:*"
    ],
    "vendor": "opensupports",
    "product": "opensupports",
    "versions": [
      {
        "status": "affected",
        "version": "4.11.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]