Search criteria

51 vulnerabilities found for otcms by otcms

FKIE_CVE-2024-57252

Vulnerability from fkie_nvd - Published: 2025-01-17 21:15 - Updated: 2025-04-22 19:38
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
References
cve@mitre.orghttps://github.com/J-0k3r/CVE-2024-57252Broken Link
cve@mitre.orghttps://github.com/J-0k3r/some/blob/main/ssrf.pdfBroken Link
Impacted products
Vendor Product Version
otcms otcms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "82D235B5-50D3-4875-A489-B0A460C680DD",
              "versionEndIncluding": "7.46",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OtCMS \u003c=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily."
    },
    {
      "lang": "es",
      "value": "OtCMS \u0026lt;=V7.46 es vulnerable a Server-Side Request Forgery (SSRF) en /admin/read.php, que puede leer archivos sistema arbitrariamente."
    }
  ],
  "id": "CVE-2024-57252",
  "lastModified": "2025-04-22T19:38:49.933",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-17T21:15:10.217",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/J-0k3r/CVE-2024-57252"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "https://github.com/J-0k3r/some/blob/main/ssrf.pdf"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-6772

Vulnerability from fkie_nvd - Published: 2023-12-13 19:15 - Updated: 2024-11-21 08:44
Severity ?
4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908.
References
cna@vuldb.comhttps://github.com/Num-Nine/CVE/issues/8Exploit, Issue Tracking, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?ctiid.247908Permissions Required, Third Party Advisory, VDB Entry
cna@vuldb.comhttps://vuldb.com/?id.247908Permissions Required, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://github.com/Num-Nine/CVE/issues/8Exploit, Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.247908Permissions Required, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.247908Permissions Required, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
otcms otcms 7.01
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:7.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "18E47DA7-DFAF-4D23-A3F5-3C1631975FA1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue encontrada en OTCMS 7.01 y clasificada como cr\u00edtica. Una funci\u00f3n desconocida del archivo /admin/ind_backstage.php es afectada por esta vulnerabilidad. La manipulaci\u00f3n del argumento sqlContent conduce a la inyecci\u00f3n de SQL. Es posible lanzar el ataque de forma remota. El exploit ha sido divulgado al p\u00fablico y puede utilizarse. El identificador de esta vulnerabilidad es VDB-247908."
    }
  ],
  "id": "CVE-2023-6772",
  "lastModified": "2024-11-21T08:44:31.683",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "MULTIPLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.4,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-12-13T19:15:08.513",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Num-Nine/CVE/issues/8"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/?ctiid.247908"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/?id.247908"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Num-Nine/CVE/issues/8"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/?ctiid.247908"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://vuldb.com/?id.247908"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-3241

Vulnerability from fkie_nvd - Published: 2023-06-14 09:15 - Updated: 2024-11-21 08:16
Severity ?
3.5 (Low) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
References
cna@vuldb.comhttps://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.mdExploit
cna@vuldb.comhttps://vuldb.com/?ctiid.231512Permissions Required, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.231512Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.mdExploit
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.231512Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.231512Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D15D5B62-76C4-47E8-8039-402DDCC3E233",
              "versionEndIncluding": "6.62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en OTCMS hasta la versi\u00f3n 6.62 y se ha clasificado como problem\u00e1tica. Este problema afecta a una funcionalidad desconocida del archivo \"/admin/read.php?mudi=announContent\". La manipulaci\u00f3n del argumento url conduce a un salto de ruta. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El identificador de esta vulnerabilidad es VDB-231512. "
    }
  ],
  "id": "CVE-2023-3241",
  "lastModified": "2024-11-21T08:16:46.750",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.1,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-14T09:15:09.783",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231512"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231512"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231512"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231512"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2023-3240

Vulnerability from fkie_nvd - Published: 2023-06-14 09:15 - Updated: 2024-11-21 08:16
Severity ?
3.5 (Low) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.
References
cna@vuldb.comhttps://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.mdExploit
cna@vuldb.comhttps://vuldb.com/?ctiid.231511Permissions Required, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.231511Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.mdExploit
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.231511Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.231511Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D15D5B62-76C4-47E8-8039-402DDCC3E233",
              "versionEndIncluding": "6.62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad en OTCMS hasta la versi\u00f3n 6.62 y se ha clasificado como problem\u00e1tica. Una funcionalidad desconocida del archivo \"usersNews_deal.php\" est\u00e1 afectada por esta vulnerabilidad. La manipulaci\u00f3n del argumento \"file\" conduce a un salto de ruta: \"../filedir\". El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El identificador asociado de esta vulnerabilidad es VDB-231511. "
    }
  ],
  "id": "CVE-2023-3240",
  "lastModified": "2024-11-21T08:16:46.590",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.1,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-14T09:15:09.717",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231511"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231511"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231511"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231511"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-3239

Vulnerability from fkie_nvd - Published: 2023-06-14 09:15 - Updated: 2024-11-21 08:16
Severity ?
3.5 (Low) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
References
cna@vuldb.comhttps://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.mdExploit
cna@vuldb.comhttps://vuldb.com/?ctiid.231510Permissions Required, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.231510Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.mdExploit
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.231510Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.231510Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D15D5B62-76C4-47E8-8039-402DDCC3E233",
              "versionEndIncluding": "6.62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad, clasificada como problem\u00e1tica, en OTCMS hasta la versi\u00f3n 6.62. Se ve afectada una funci\u00f3n desconocida del archivo \"admin/readDeal.php?mudi=readQrCode\". La manipulaci\u00f3n del argumento \"img\" conduce a un salto de ruta: \"../filedir\". El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El identificador asignado a esta vulnerabilidad es: VDB-231510. "
    }
  ],
  "id": "CVE-2023-3239",
  "lastModified": "2024-11-21T08:16:46.437",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 5.1,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-14T09:15:09.333",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231510"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231510"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231510"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231510"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-3237

Vulnerability from fkie_nvd - Published: 2023-06-14 08:15 - Updated: 2024-11-21 08:16
Severity ?
6.3 (Medium) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
References
cna@vuldb.comhttps://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.mdExploit
cna@vuldb.comhttps://vuldb.com/?ctiid.231508Permissions Required, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.231508Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.mdExploit
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.231508Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.231508Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D15D5B62-76C4-47E8-8039-402DDCC3E233",
              "versionEndIncluding": "6.62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad clasificada como cr\u00edtica en OTCMS hasta la versi\u00f3n 6.62. Esta vulnerabilidad afecta a c\u00f3digo desconocido. La manipulaci\u00f3n del argumento \"username/password\" con el input \"admin\" lleva al uso de una contrase\u00f1a embebida. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. El identificador de esta vulnerabilidad es VDB-231508. "
    }
  ],
  "id": "CVE-2023-3237",
  "lastModified": "2024-11-21T08:16:46.130",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.5,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-14T08:15:09.640",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231508"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231508"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231508"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231508"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-259"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2023-3238

Vulnerability from fkie_nvd - Published: 2023-06-14 08:15 - Updated: 2024-11-21 08:16
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability.
References
cna@vuldb.comhttps://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).mdExploit
cna@vuldb.comhttps://vuldb.com/?ctiid.231509Permissions Required, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.231509Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).mdExploit
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.231509Permissions Required, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.231509Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D15D5B62-76C4-47E8-8039-402DDCC3E233",
              "versionEndIncluding": "6.62",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability."
    },
    {
      "lang": "es",
      "value": "Se ha encontrado una vulnerabilidad, clasificada como cr\u00edtica, en OTCMS hasta la versi\u00f3n 6.62. Este problema afecta a alg\u00fan procesamiento desconocido del archivo \"/admin/read.php?mudi=getSignal\". La manipulaci\u00f3n del argumento \"signalUrl\" conduce a la falsificaci\u00f3n de peticiones del lado del servidor. El ataque puede iniciarse de forma remota. El exploit ha sido revelado al p\u00fablico y puede ser utilizado. Se ha asignado el identificador VDB-231509 a esta vulnerabilidad. "
    }
  ],
  "id": "CVE-2023-3238",
  "lastModified": "2024-11-21T08:16:46.277",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-06-14T08:15:09.713",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231509"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231509"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.231509"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.231509"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    }
  ]
}

FKIE_CVE-2023-1797

Vulnerability from fkie_nvd - Published: 2023-04-02 10:15 - Updated: 2024-11-21 07:39
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability.
References
cna@vuldb.comhttps://gitee.com/wkstestete/cve/blob/master/upload/upload1.mdExploit, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?ctiid.224749Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.224749Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://gitee.com/wkstestete/cve/blob/master/upload/upload1.mdExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.224749Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.224749Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms 6.01
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:6.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "539BAC83-D8EC-4C6B-9A60-BF7C762B78A0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability."
    }
  ],
  "id": "CVE-2023-1797",
  "lastModified": "2024-11-21T07:39:55.473",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-04-02T10:15:06.947",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.224749"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.224749"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.224749"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.224749"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2023-1635

Vulnerability from fkie_nvd - Published: 2023-03-25 19:15 - Updated: 2024-11-21 07:39
Severity ?
3.5 (Low) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.
References
cna@vuldb.comhttps://github.com/BigTiger2020/2023/blob/main/XSS.mdExploit, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?ctiid.224017Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.224017Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/BigTiger2020/2023/blob/main/XSS.mdExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.224017Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.224017Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms 6.72
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:6.72:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9553B93-A57B-4F29-9217-B8EC9FE077AA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability."
    }
  ],
  "id": "CVE-2023-1635",
  "lastModified": "2024-11-21T07:39:35.633",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 1.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-03-25T19:15:06.990",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.224017"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.224017"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.224017"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.224017"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

FKIE_CVE-2023-1634

Vulnerability from fkie_nvd - Published: 2023-03-25 19:15 - Updated: 2024-11-21 07:39
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.
References
cna@vuldb.comhttps://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.mdExploit, Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?ctiid.224016Third Party Advisory
cna@vuldb.comhttps://vuldb.com/?id.224016Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.mdExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?ctiid.224016Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://vuldb.com/?id.224016Third Party Advisory
Impacted products
Vendor Product Version
otcms otcms 6.72
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:otcms:otcms:6.72:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9553B93-A57B-4F29-9217-B8EC9FE077AA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016."
    }
  ],
  "id": "CVE-2023-1634",
  "lastModified": "2024-11-21T07:39:35.493",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "cna@vuldb.com",
        "type": "Secondary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "cna@vuldb.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2023-03-25T19:15:06.933",
  "references": [
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.224016"
    },
    {
      "source": "cna@vuldb.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.224016"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?ctiid.224016"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://vuldb.com/?id.224016"
    }
  ],
  "sourceIdentifier": "cna@vuldb.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "cna@vuldb.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2024-57252 (GCVE-0-2024-57252)

Vulnerability from cvelistv5 – Published: 2025-01-17 00:00 – Updated: 2025-01-17 21:14
VLAI?
Summary
OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57252",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-17T21:13:38.625100Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-17T21:14:18.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OtCMS \u003c=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-17T20:17:18.159297",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/J-0k3r/some/blob/main/ssrf.pdf"
        },
        {
          "url": "https://github.com/J-0k3r/CVE-2024-57252"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-57252",
    "datePublished": "2025-01-17T00:00:00",
    "dateReserved": "2025-01-09T00:00:00",
    "dateUpdated": "2025-01-17T21:14:18.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6772 (GCVE-0-2023-6772)

Vulnerability from cvelistv5 – Published: 2023-12-13 19:00 – Updated: 2025-05-22 18:05
VLAI?
Title
OTCMS ind_backstage.php sql injection
Summary
A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908.
Severity ?
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.7 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
https://vuldb.com/?id.247908 vdb-entrytechnical-description
https://vuldb.com/?ctiid.247908 signaturepermissions-required
https://github.com/Num-Nine/CVE/issues/8 exploitissue-tracking
Impacted products
Vendor Product Version
n/a OTCMS Affected: 7.01
Credits
wuguanfengyue (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:42:07.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.247908"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.247908"
          },
          {
            "tags": [
              "exploit",
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/Num-Nine/CVE/issues/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6772",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T18:04:45.703959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T18:05:37.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "7.01"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "wuguanfengyue (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in OTCMS 7.01 gefunden. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /admin/ind_backstage.php. Dank Manipulation des Arguments sqlContent mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-13T19:00:06.215Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.247908"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.247908"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/Num-Nine/CVE/issues/8"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-13T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-12-13T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-12-13T13:28:46.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS ind_backstage.php sql injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-6772",
    "datePublished": "2023-12-13T19:00:06.215Z",
    "dateReserved": "2023-12-13T12:23:34.610Z",
    "dateUpdated": "2025-05-22T18:05:37.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3241 (GCVE-0-2023-3241)

Vulnerability from cvelistv5 – Published: 2023-06-14 09:00 – Updated: 2024-08-02 06:48
VLAI?
Title
OTCMS path traversal
Summary
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
Severity ?
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
https://vuldb.com/?id.231512 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231512 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231512"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231512"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in OTCMS bis 6.62 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /admin/read.php?mudi=announContent. Mittels Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.7,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:33:20.292Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231512"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231512"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T10:04:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3241",
    "datePublished": "2023-06-14T09:00:03.857Z",
    "dateReserved": "2023-06-14T06:12:47.461Z",
    "dateUpdated": "2024-08-02T06:48:08.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3240 (GCVE-0-2023-3240)

Vulnerability from cvelistv5 – Published: 2023-06-14 08:31 – Updated: 2024-11-21 16:06
VLAI?
Title
OTCMS usersNews_deal.php path traversal
Summary
A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.
Severity ?
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-24 - Path Traversal: '../filedir'
Assigner
References
https://vuldb.com/?id.231511 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231511 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.509Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231511"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231511"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-21T16:06:39.308991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T16:06:53.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511."
        },
        {
          "lang": "de",
          "value": "In OTCMS bis 6.62 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei usersNews_deal.php. Mittels dem Manipulieren des Arguments file mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.7,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:35:51.673Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231511"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231511"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T10:00:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS usersNews_deal.php path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3240",
    "datePublished": "2023-06-14T08:31:04.377Z",
    "dateReserved": "2023-06-14T06:12:42.962Z",
    "dateUpdated": "2024-11-21T16:06:53.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3239 (GCVE-0-2023-3239)

Vulnerability from cvelistv5 – Published: 2023-06-14 08:31 – Updated: 2024-08-02 06:48
VLAI?
Title
OTCMS path traversal
Summary
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
Severity ?
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-24 - Path Traversal: '../filedir'
Assigner
References
https://vuldb.com/?id.231510 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231510 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.286Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231510"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231510"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in OTCMS bis 6.62 gefunden. Sie wurde als problematisch eingestuft. Es betrifft eine unbekannte Funktion der Datei admin/readDeal.php?mudi=readQrCode. Durch Manipulation des Arguments img mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.7,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:39:22.646Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231510"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231510"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T09:56:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3239",
    "datePublished": "2023-06-14T08:31:03.407Z",
    "dateReserved": "2023-06-14T06:12:39.708Z",
    "dateUpdated": "2024-08-02T06:48:08.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3238 (GCVE-0-2023-3238)

Vulnerability from cvelistv5 – Published: 2023-06-14 08:00 – Updated: 2025-01-02 20:40
VLAI?
Title
OTCMS server-side request forgery
Summary
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
References
https://vuldb.com/?id.231509 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231509 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.194Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231509"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231509"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-02T20:40:02.501241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-02T20:40:18.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in OTCMS bis 6.62 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /admin/read.php?mudi=getSignal. Durch die Manipulation des Arguments signalUrl mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:38:01.904Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231509"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231509"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T09:50:47.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3238",
    "datePublished": "2023-06-14T08:00:04.536Z",
    "dateReserved": "2023-06-14T06:12:36.410Z",
    "dateUpdated": "2025-01-02T20:40:18.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3237 (GCVE-0-2023-3237)

Vulnerability from cvelistv5 – Published: 2023-06-14 07:31 – Updated: 2024-08-02 06:48
VLAI?
Title
OTCMS hard-coded password
Summary
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-259 - Use of Hard-coded Password
Assigner
References
https://vuldb.com/?id.231508 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231508 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T14:44:49.636969Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-18T14:46:21.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.227Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231508"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231508"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."
        },
        {
          "lang": "de",
          "value": "In OTCMS bis 6.62 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion. Mit der Manipulation des Arguments username/password mit der Eingabe admin mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259 Use of Hard-coded Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:34:51.152Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231508"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231508"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T09:47:27.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS hard-coded password"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3237",
    "datePublished": "2023-06-14T07:31:03.348Z",
    "dateReserved": "2023-06-14T06:12:33.580Z",
    "dateUpdated": "2024-08-02T06:48:08.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1797 (GCVE-0-2023-1797)

Vulnerability from cvelistv5 – Published: 2023-04-02 09:00 – Updated: 2024-08-02 06:05
VLAI?
Title
OTCMS unrestricted upload
Summary
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0.1
Credits
wkstestete (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:05:26.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.224749"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.224749"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "wkstestete (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "In OTCMS 6.0.1 wurde eine kritische Schwachstelle entdeckt. Hierbei betrifft es unbekannten Programmcode der Datei sysCheckFile.php?mudi=sql. Durch Manipulieren mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-21T14:34:21.879Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.224749"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.224749"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-04-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-04-02T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-04-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-21T14:11:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS unrestricted upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-1797",
    "datePublished": "2023-04-02T09:00:07.864Z",
    "dateReserved": "2023-04-02T07:27:18.541Z",
    "dateUpdated": "2024-08-02T06:05:26.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1635 (GCVE-0-2023-1635)

Vulnerability from cvelistv5 – Published: 2023-03-25 19:00 – Updated: 2025-02-14 16:09
VLAI?
Title
OTCMS apiRun.php AutoRun cross site scripting
Summary
A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low)
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CWE
  • CWE-79 - Cross Site Scripting
Assigner
References
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.72
Credits
fzh1613 (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.370Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.224017"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.224017"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1635",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T16:09:37.641680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T16:09:51.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.72"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "fzh1613 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "In OTCMS 6.72 wurde eine problematische Schwachstelle ausgemacht. Betroffen ist die Funktion AutoRun der Datei apiRun.php. Mit der Manipulation des Arguments mode mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-21T13:26:03.756Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.224017"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.224017"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-03-25T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-15T10:51:56.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS apiRun.php AutoRun cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-1635",
    "datePublished": "2023-03-25T19:00:05.453Z",
    "dateReserved": "2023-03-25T18:03:19.149Z",
    "dateUpdated": "2025-02-14T16:09:51.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1634 (GCVE-0-2023-1634)

Vulnerability from cvelistv5 – Published: 2023-03-25 18:31 – Updated: 2024-08-02 05:57
VLAI?
Title
OTCMS URL Parameter info_deal.php UseCurl server-side request forgery
Summary
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
References
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.72
Credits
fzh1613 (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.427Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.224016"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.224016"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "URL Parameter Handler"
          ],
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.72"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "fzh1613 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016."
        },
        {
          "lang": "de",
          "value": "Es wurde eine kritische Schwachstelle in OTCMS 6.72 ausgemacht. Hiervon betroffen ist die Funktion UseCurl der Datei /admin/info_deal.php der Komponente URL Parameter Handler. Dank Manipulation mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-21T13:24:50.572Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.224016"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.224016"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-03-25T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-15T10:39:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS URL Parameter info_deal.php UseCurl server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-1634",
    "datePublished": "2023-03-25T18:31:03.362Z",
    "dateReserved": "2023-03-25T18:01:16.544Z",
    "dateUpdated": "2024-08-02T05:57:24.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-57252 (GCVE-0-2024-57252)

Vulnerability from nvd – Published: 2025-01-17 00:00 – Updated: 2025-01-17 21:14
VLAI?
Summary
OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily.
Severity ?
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-57252",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-17T21:13:38.625100Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-918",
                "description": "CWE-918 Server-Side Request Forgery (SSRF)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-17T21:14:18.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OtCMS \u003c=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbitrarily."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-17T20:17:18.159297",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/J-0k3r/some/blob/main/ssrf.pdf"
        },
        {
          "url": "https://github.com/J-0k3r/CVE-2024-57252"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-57252",
    "datePublished": "2025-01-17T00:00:00",
    "dateReserved": "2025-01-09T00:00:00",
    "dateUpdated": "2025-01-17T21:14:18.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6772 (GCVE-0-2023-6772)

Vulnerability from nvd – Published: 2023-12-13 19:00 – Updated: 2025-05-22 18:05
VLAI?
Title
OTCMS ind_backstage.php sql injection
Summary
A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908.
Severity ?
4.7 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
4.7 (Medium)
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
https://vuldb.com/?id.247908 vdb-entrytechnical-description
https://vuldb.com/?ctiid.247908 signaturepermissions-required
https://github.com/Num-Nine/CVE/issues/8 exploitissue-tracking
Impacted products
Vendor Product Version
n/a OTCMS Affected: 7.01
Credits
wuguanfengyue (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:42:07.219Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.247908"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.247908"
          },
          {
            "tags": [
              "exploit",
              "issue-tracking",
              "x_transferred"
            ],
            "url": "https://github.com/Num-Nine/CVE/issues/8"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-6772",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-22T18:04:45.703959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-22T18:05:37.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "7.01"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "wuguanfengyue (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as critical, was found in OTCMS 7.01. Affected is an unknown function of the file /admin/ind_backstage.php. The manipulation of the argument sqlContent leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247908."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in OTCMS 7.01 gefunden. Sie wurde als kritisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei /admin/ind_backstage.php. Dank Manipulation des Arguments sqlContent mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:N/AC:L/Au:M/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-13T19:00:06.215Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.247908"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.247908"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/Num-Nine/CVE/issues/8"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-12-13T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-12-13T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-12-13T13:28:46.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS ind_backstage.php sql injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-6772",
    "datePublished": "2023-12-13T19:00:06.215Z",
    "dateReserved": "2023-12-13T12:23:34.610Z",
    "dateUpdated": "2025-05-22T18:05:37.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3241 (GCVE-0-2023-3241)

Vulnerability from nvd – Published: 2023-06-14 09:00 – Updated: 2024-08-02 06:48
VLAI?
Title
OTCMS path traversal
Summary
A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512.
Severity ?
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
Assigner
References
https://vuldb.com/?id.231512 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231512 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.520Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231512"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231512"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in OTCMS up to 6.62 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/read.php?mudi=announContent. The manipulation of the argument url leads to path traversal. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231512."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in OTCMS bis 6.62 gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /admin/read.php?mudi=announContent. Mittels Manipulieren des Arguments url mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.7,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:33:20.292Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231512"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231512"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20read%20vulenrability%20via%20the%20filename.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T10:04:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3241",
    "datePublished": "2023-06-14T09:00:03.857Z",
    "dateReserved": "2023-06-14T06:12:47.461Z",
    "dateUpdated": "2024-08-02T06:48:08.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3240 (GCVE-0-2023-3240)

Vulnerability from nvd – Published: 2023-06-14 08:31 – Updated: 2024-11-21 16:06
VLAI?
Title
OTCMS usersNews_deal.php path traversal
Summary
A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511.
Severity ?
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-24 - Path Traversal: '../filedir'
Assigner
References
https://vuldb.com/?id.231511 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231511 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.509Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231511"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231511"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-21T16:06:39.308991Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-21T16:06:53.483Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been found in OTCMS up to 6.62 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file usersNews_deal.php. The manipulation of the argument file leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231511."
        },
        {
          "lang": "de",
          "value": "In OTCMS bis 6.62 wurde eine Schwachstelle gefunden. Sie wurde als problematisch eingestuft. Das betrifft eine unbekannte Funktionalit\u00e4t der Datei usersNews_deal.php. Mittels dem Manipulieren des Arguments file mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.7,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:35:51.673Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231511"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231511"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20to%20contain%20an%20arbitrary%20file%20download%20vulenrability%20via%20the%20filename.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T10:00:15.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS usersNews_deal.php path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3240",
    "datePublished": "2023-06-14T08:31:04.377Z",
    "dateReserved": "2023-06-14T06:12:42.962Z",
    "dateUpdated": "2024-11-21T16:06:53.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3239 (GCVE-0-2023-3239)

Vulnerability from nvd – Published: 2023-06-14 08:31 – Updated: 2024-08-02 06:48
VLAI?
Title
OTCMS path traversal
Summary
A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability.
Severity ?
3.5 (Low)
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
3.5 (Low)
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-24 - Path Traversal: '../filedir'
Assigner
References
https://vuldb.com/?id.231510 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231510 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.286Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231510"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231510"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as problematic, was found in OTCMS up to 6.62. Affected is an unknown function of the file admin/readDeal.php?mudi=readQrCode. The manipulation of the argument img leads to path traversal: \u0027../filedir\u0027. The exploit has been disclosed to the public and may be used. VDB-231510 is the identifier assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "Es wurde eine Schwachstelle in OTCMS bis 6.62 gefunden. Sie wurde als problematisch eingestuft. Es betrifft eine unbekannte Funktion der Datei admin/readDeal.php?mudi=readQrCode. Durch Manipulation des Arguments img mit unbekannten Daten kann eine path traversal: \u0027../filedir\u0027-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 2.7,
            "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24 Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:39:22.646Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231510"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231510"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20was%20discovered%20obtain%20the%20web%20directory%20path%20and%20other%20information%20leaked%20.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T09:56:28.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS path traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3239",
    "datePublished": "2023-06-14T08:31:03.407Z",
    "dateReserved": "2023-06-14T06:12:39.708Z",
    "dateUpdated": "2024-08-02T06:48:08.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3238 (GCVE-0-2023-3238)

Vulnerability from nvd – Published: 2023-06-14 08:00 – Updated: 2025-01-02 20:40
VLAI?
Title
OTCMS server-side request forgery
Summary
A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
References
https://vuldb.com/?id.231509 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231509 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.194Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231509"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231509"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-02T20:40:02.501241Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-02T20:40:18.187Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability, which was classified as critical, has been found in OTCMS up to 6.62. This issue affects some unknown processing of the file /admin/read.php?mudi=getSignal. The manipulation of the argument signalUrl leads to server-side request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-231509 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "Eine Schwachstelle wurde in OTCMS bis 6.62 entdeckt. Sie wurde als kritisch eingestuft. Hierbei geht es um eine nicht exakt ausgemachte Funktion der Datei /admin/read.php?mudi=getSignal. Durch die Manipulation des Arguments signalUrl mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:38:01.904Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231509"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231509"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF).md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T09:50:47.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3238",
    "datePublished": "2023-06-14T08:00:04.536Z",
    "dateReserved": "2023-06-14T06:12:36.410Z",
    "dateUpdated": "2025-01-02T20:40:18.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-3237 (GCVE-0-2023-3237)

Vulnerability from nvd – Published: 2023-06-14 07:31 – Updated: 2024-08-02 06:48
VLAI?
Title
OTCMS hard-coded password
Summary
A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-259 - Use of Hard-coded Password
Assigner
References
https://vuldb.com/?id.231508 vdb-entrytechnical-description
https://vuldb.com/?ctiid.231508 signaturepermissions-required
https://github.com/HuBenLab/HuBenVulList/blob/mai… broken-linkexploit
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0
Affected: 6.1
Affected: 6.2
Affected: 6.3
Affected: 6.4
Affected: 6.5
Affected: 6.6
Affected: 6.7
Affected: 6.8
Affected: 6.9
Affected: 6.10
Affected: 6.11
Affected: 6.12
Affected: 6.13
Affected: 6.14
Affected: 6.15
Affected: 6.16
Affected: 6.17
Affected: 6.18
Affected: 6.19
Affected: 6.20
Affected: 6.21
Affected: 6.22
Affected: 6.23
Affected: 6.24
Affected: 6.25
Affected: 6.26
Affected: 6.27
Affected: 6.28
Affected: 6.29
Affected: 6.30
Affected: 6.31
Affected: 6.32
Affected: 6.33
Affected: 6.34
Affected: 6.35
Affected: 6.36
Affected: 6.37
Affected: 6.38
Affected: 6.39
Affected: 6.40
Affected: 6.41
Affected: 6.42
Affected: 6.43
Affected: 6.44
Affected: 6.45
Affected: 6.46
Affected: 6.47
Affected: 6.48
Affected: 6.49
Affected: 6.50
Affected: 6.51
Affected: 6.52
Affected: 6.53
Affected: 6.54
Affected: 6.55
Affected: 6.56
Affected: 6.57
Affected: 6.58
Affected: 6.59
Affected: 6.60
Affected: 6.61
Affected: 6.62
Credits
p0ison (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-3237",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T14:44:49.636969Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-18T14:46:21.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:48:08.227Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.231508"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.231508"
          },
          {
            "tags": [
              "broken-link",
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "status": "affected",
              "version": "6.15"
            },
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "status": "affected",
              "version": "6.20"
            },
            {
              "status": "affected",
              "version": "6.21"
            },
            {
              "status": "affected",
              "version": "6.22"
            },
            {
              "status": "affected",
              "version": "6.23"
            },
            {
              "status": "affected",
              "version": "6.24"
            },
            {
              "status": "affected",
              "version": "6.25"
            },
            {
              "status": "affected",
              "version": "6.26"
            },
            {
              "status": "affected",
              "version": "6.27"
            },
            {
              "status": "affected",
              "version": "6.28"
            },
            {
              "status": "affected",
              "version": "6.29"
            },
            {
              "status": "affected",
              "version": "6.30"
            },
            {
              "status": "affected",
              "version": "6.31"
            },
            {
              "status": "affected",
              "version": "6.32"
            },
            {
              "status": "affected",
              "version": "6.33"
            },
            {
              "status": "affected",
              "version": "6.34"
            },
            {
              "status": "affected",
              "version": "6.35"
            },
            {
              "status": "affected",
              "version": "6.36"
            },
            {
              "status": "affected",
              "version": "6.37"
            },
            {
              "status": "affected",
              "version": "6.38"
            },
            {
              "status": "affected",
              "version": "6.39"
            },
            {
              "status": "affected",
              "version": "6.40"
            },
            {
              "status": "affected",
              "version": "6.41"
            },
            {
              "status": "affected",
              "version": "6.42"
            },
            {
              "status": "affected",
              "version": "6.43"
            },
            {
              "status": "affected",
              "version": "6.44"
            },
            {
              "status": "affected",
              "version": "6.45"
            },
            {
              "status": "affected",
              "version": "6.46"
            },
            {
              "status": "affected",
              "version": "6.47"
            },
            {
              "status": "affected",
              "version": "6.48"
            },
            {
              "status": "affected",
              "version": "6.49"
            },
            {
              "status": "affected",
              "version": "6.50"
            },
            {
              "status": "affected",
              "version": "6.51"
            },
            {
              "status": "affected",
              "version": "6.52"
            },
            {
              "status": "affected",
              "version": "6.53"
            },
            {
              "status": "affected",
              "version": "6.54"
            },
            {
              "status": "affected",
              "version": "6.55"
            },
            {
              "status": "affected",
              "version": "6.56"
            },
            {
              "status": "affected",
              "version": "6.57"
            },
            {
              "status": "affected",
              "version": "6.58"
            },
            {
              "status": "affected",
              "version": "6.59"
            },
            {
              "status": "affected",
              "version": "6.60"
            },
            {
              "status": "affected",
              "version": "6.61"
            },
            {
              "status": "affected",
              "version": "6.62"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "p0ison (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as critical was found in OTCMS up to 6.62. This vulnerability affects unknown code. The manipulation of the argument username/password with the input admin leads to use of hard-coded password. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231508."
        },
        {
          "lang": "de",
          "value": "In OTCMS bis 6.62 wurde eine Schwachstelle entdeckt. Sie wurde als kritisch eingestuft. Dabei geht es um eine nicht genauer bekannte Funktion. Mit der Manipulation des Arguments username/password mit der Eingabe admin mit unbekannten Daten kann eine use of hard-coded password-Schwachstelle ausgenutzt werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5.8,
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-259",
              "description": "CWE-259 Use of Hard-coded Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-13T07:34:51.152Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.231508"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.231508"
        },
        {
          "tags": [
            "broken-link",
            "exploit"
          ],
          "url": "https://github.com/HuBenLab/HuBenVulList/blob/main/OTCMS%20contains%20a%20weak%20default%20password%20which%20gives%20attackers%20to%20access%20backstage%20management%20system.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-06-14T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-06-14T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-07-13T09:47:27.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS hard-coded password"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-3237",
    "datePublished": "2023-06-14T07:31:03.348Z",
    "dateReserved": "2023-06-14T06:12:33.580Z",
    "dateUpdated": "2024-08-02T06:48:08.227Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1797 (GCVE-0-2023-1797)

Vulnerability from nvd – Published: 2023-04-02 09:00 – Updated: 2024-08-02 06:05
VLAI?
Title
OTCMS unrestricted upload
Summary
A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.0.1
Credits
wkstestete (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T06:05:26.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.224749"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.224749"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.1"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "wkstestete (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability classified as critical was found in OTCMS 6.0.1. Affected by this vulnerability is an unknown functionality of the file sysCheckFile.php?mudi=sql. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224749 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "In OTCMS 6.0.1 wurde eine kritische Schwachstelle entdeckt. Hierbei betrifft es unbekannten Programmcode der Datei sysCheckFile.php?mudi=sql. Durch Manipulieren mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff \u00fcber das Netzwerk. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434 Unrestricted Upload",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-21T14:34:21.879Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.224749"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.224749"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://gitee.com/wkstestete/cve/blob/master/upload/upload1.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-04-02T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-04-02T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-04-02T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-21T14:11:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS unrestricted upload"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-1797",
    "datePublished": "2023-04-02T09:00:07.864Z",
    "dateReserved": "2023-04-02T07:27:18.541Z",
    "dateUpdated": "2024-08-02T06:05:26.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1635 (GCVE-0-2023-1635)

Vulnerability from nvd – Published: 2023-03-25 19:00 – Updated: 2025-02-14 16:09
VLAI?
Title
OTCMS apiRun.php AutoRun cross site scripting
Summary
A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability.
Severity ?
3.5 (Low)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
3.5 (Low)
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CWE
  • CWE-79 - Cross Site Scripting
Assigner
References
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.72
Credits
fzh1613 (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.370Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.224017"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.224017"
          },
          {
            "tags": [
              "related",
              "x_transferred"
            ],
            "url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-1635",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T16:09:37.641680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T16:09:51.822Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.72"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "fzh1613 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross site scripting. The attack can be launched remotely. The identifier VDB-224017 was assigned to this vulnerability."
        },
        {
          "lang": "de",
          "value": "In OTCMS 6.72 wurde eine problematische Schwachstelle ausgemacht. Betroffen ist die Funktion AutoRun der Datei apiRun.php. Mit der Manipulation des Arguments mode mit unbekannten Daten kann eine cross site scripting-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk passieren."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 4,
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross Site Scripting",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-21T13:26:03.756Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.224017"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.224017"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/BigTiger2020/2023/blob/main/XSS.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-03-25T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-15T10:51:56.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS apiRun.php AutoRun cross site scripting"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-1635",
    "datePublished": "2023-03-25T19:00:05.453Z",
    "dateReserved": "2023-03-25T18:03:19.149Z",
    "dateUpdated": "2025-02-14T16:09:51.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-1634 (GCVE-0-2023-1634)

Vulnerability from nvd – Published: 2023-03-25 18:31 – Updated: 2024-08-02 05:57
VLAI?
Title
OTCMS URL Parameter info_deal.php UseCurl server-side request forgery
Summary
A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016.
Severity ?
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
6.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-918 - Server-Side Request Forgery
Assigner
References
Impacted products
Vendor Product Version
n/a OTCMS Affected: 6.72
Credits
fzh1613 (VulDB User)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:57:24.427Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "technical-description",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?id.224016"
          },
          {
            "tags": [
              "signature",
              "permissions-required",
              "x_transferred"
            ],
            "url": "https://vuldb.com/?ctiid.224016"
          },
          {
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "modules": [
            "URL Parameter Handler"
          ],
          "product": "OTCMS",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.72"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "analyst",
          "value": "fzh1613 (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.php of the component URL Parameter Handler. The manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224016."
        },
        {
          "lang": "de",
          "value": "Es wurde eine kritische Schwachstelle in OTCMS 6.72 ausgemacht. Hiervon betroffen ist die Funktion UseCurl der Datei /admin/info_deal.php der Komponente URL Parameter Handler. Dank Manipulation mit unbekannten Daten kann eine server-side request forgery-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 6.5,
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-10-21T13:24:50.572Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/?id.224016"
        },
        {
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/?ctiid.224016"
        },
        {
          "tags": [
            "exploit"
          ],
          "url": "https://github.com/BigTiger2020/2023-1/blob/main/ssrf/ssrf.md"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2023-03-25T00:00:00.000Z",
          "value": "CVE reserved"
        },
        {
          "lang": "en",
          "time": "2023-03-25T01:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2023-04-15T10:39:49.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "OTCMS URL Parameter info_deal.php UseCurl server-side request forgery"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2023-1634",
    "datePublished": "2023-03-25T18:31:03.362Z",
    "dateReserved": "2023-03-25T18:01:16.544Z",
    "dateUpdated": "2024-08-02T05:57:24.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}