Description
A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228014 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Weaver | E-Office | 9.5 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
Any3ite/CVE-2023-2523 ★ 1 · Sep 25, 2023
-
werwolfz/cve-2023-2523-and-cve-2023-2648 ★ 0 · Oct 25, 2023
泛微 cve-2023-2523-and-cve-2023-2648
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://vuldb.com/?id.228014 vdb-entry technical-description
- https://vuldb.com/?ctiid.228014 signature permissions-required
- https://github.com/RCEraser/cve/blob/main/Weaver.md exploit