high7.8Public exploit code
CVE-2023-39147
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)2023-07-31 · webapps · php · Verified
Impact
An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Webkul | Uvdesk | Version 1.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html
- https://docs.google.com/document/d/1uv9DjHmKuDxZIjNhWX05EsxHEp8fGalXB7XK-QSyr_0/edit?usp=sharing
- http://packetstormsecurity.com/files/173878/Uvdesk-1.1.3-Shell-Upload.html
- https://docs.google.com/document/d/1uv9DjHmKuDxZIjNhWX05EsxHEp8fGalXB7XK-QSyr_0/edit?usp=sharing