medium6.5
CVE-2023-49006
Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability
Impact
Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file. Phpsysinfo 3.4.3 disables the functionality by default but the users may enable the vulnerable functionality.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | phpsysinfo/phpsysinfo | < 3.4.3 | 3.4.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phpsysinfo | Phpsysinfo | Version 3.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/Hebing123/cve/issues/5
- https://github.com/phpsysinfo/phpsysinfo/commit/4f2cee505e4f2e9b369a321063ff2c5e0c34ba45
- https://huntr.com/bounties/ca6d669f-fd82-4188-aae2-69e08740d982/
- https://github.com/advisories/GHSA-67gv-xrw7-p72w
- https://nvd.nist.gov/vuln/detail/CVE-2023-49006