Skip to content

Instantly share code, notes, and snippets.

@ChubbyZ

ChubbyZ/CVE-2023-42321

Last active September 20, 2023 06:18
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ChubbyZ/cb4b8fd818846dec3e9d70863e7955bc to your computer and use it in GitHub Desktop.
Save ChubbyZ/cb4b8fd818846dec3e9d70863e7955bc to your computer and use it in GitHub Desktop.
Download ZIP
CVE-2023-42321
Raw
CVE-2023-42321
[CVE-ID]
CVE-2023-42321
[CNVD-ID]
CNVD-2023-68150
[Description]
In the iCMS V7.0.16 version, the session in the session is hijacked, and members, roles and administrator accounts can be added arbitrarily without logging in to the account.
------------------------------------------
[Vulnerability Type]
Insecure Permissions
------------------------------------------
[Vendor of Product]
icmsdev
------------------------------------------
[Affected Product Code Base]
icms - V7.0.16
------------------------------------------
[Affected Component]
Backend-User Management-Add Administrator/Add Member/Member Management/Role Management, etc.
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Code execution]
true
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
Hijack the session in the session
------------------------------------------
[Reference]
https://www.icmsdev.com/
------------------------------------------
[Discoverer]
chubby
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment