Skip to main content

Thinkadmin CVE-2023-48966

HIGH
Unrestricted Upload of File with Dangerous Type (CWE-434)
2023-12-04 cve@mitre.org
RCE File Upload Thinkadmin
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 04, 2023 - 16:15 nvd
HIGH 8.8

DescriptionNVD

An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.

AnalysisAI

An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file. Affected products include: Thinkadmin.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Thinkadmin

View all
CVE-2019-11018 CRITICAL POC
9.8 Apr 08

application\admin\controller\User.php in ThinkAdmin V4.0 does not prevent continued use of an administrator's cookie-bas
CVE-2023-48965 HIGH POC
8.8 Dec 04

An issue in the component /admin/api.plugs/script of ThinkAdmin v6.1.53 allows attackers to getshell via providing a cra
CVE-2020-25540 HIGH POC
7.5 Sep 14

ThinkAdmin v6 is affected by a directory traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2023-34833 MEDIUM POC
6.1 Jun 15

An arbitrary file upload vulnerability in the component /api/upload.php of ThinkAdmin v6 allows attackers to execute arb
CVE-2020-29315 MEDIUM POC
5.4 Dec 01

ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script

CVE-2024-10749 LOW
2.3 Nov 04

A vulnerability, which was classified as critical, was found in ThinkAdmin up to 6.1.67. Rated low severity (CVSS 2.3),

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2023-48966 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy