// For flags

CVE-2023-2453

Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.

La limpieza de nombres de archivo contaminados que se concatenan directamente con una ruta que posteriormente se pasa a una sentencia 'require_once' es insuficiente. Esto permite que se incluyan y ejecuten archivos arbitrarios con la extensión '.php' cuya ruta absoluta se conoce. No hay medios conocidos en PHPFusion a través de los cuales un atacante pueda cargar y apuntar a una carga útil de archivo '.php'.

*Credits: Matthew Hogg
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-05-01 CVE Reserved
  • 2023-09-05 CVE Published
  • 2024-08-02 CVE Updated
  • 2024-09-11 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CAPEC
  • CAPEC-252: PHP Local File Inclusion
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php-fusion
Search vendor "Php-fusion"
 Phpfusion
Search vendor "Php-fusion" for product "Phpfusion"
 <= 9.10.30
Search vendor "Php-fusion" for product "Phpfusion" and version " <= 9.10.30"
-
Affected