CVE-2023-4559
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A critical vulnerability has been found in Bettershop LaikeTui, allowing unrestricted file uploads through manipulation of functionality in the file index.php?module=api&action=user&m=upload. The attack can be launched remotely.
Risk Assessment
This vulnerability poses a serious risk to organizations by allowing attackers to upload malicious files, potentially compromising the system.
Recommendation
It is recommended to immediately block access to the vulnerable functionality and monitor the system for potential attacks.
Original NVD description (English source)
A vulnerability, which was classified as critical, has been found in Bettershop LaikeTui. Affected by this issue is some unknown functionality of the file index.php?module=api&action=user&m=upload of the component POST Request Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The identifier of this vulnerability is VDB-238160.