// For flags

CVE-2023-7055

PHPGurukul Online Notes Sharing System Contact Information profile.php access control

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.

Una vulnerabilidad ha sido encontrada en PHPGurukul Online Notes Sharing System 1.0 y clasificada como problemática. Una función desconocida del archivo /user/profile.php del componente Contact Information Handler es afectada por esta vulnerabilidad. La manipulación del argumento mobilenumber conduce a controles de acceso inadecuados. Es posible lanzar el ataque de forma remota. La explotación ha sido divulgada y puede utilizarse. VDB-248742 es el identificador asignado a esta vulnerabilidad.

Es wurde eine problematische Schwachstelle in PHPGurukul Online Notes Sharing System 1.0 entdeckt. Es geht dabei um eine nicht klar definierte Funktion der Datei /user/profile.php der Komponente Contact Information Handler. Durch Beeinflussen des Arguments mobilenumber mit unbekannten Daten kann eine improper access controls-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung.

*Credits: dhabaleshwar
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-21 CVE Reserved
  • 2023-12-22 CVE Published
  • 2023-12-29 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-284: Improper Access Control
  • CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Phpgurukul
Search vendor "Phpgurukul"
 Online Notes Sharing System
Search vendor "Phpgurukul" for product "Online Notes Sharing System"
 1.0
Search vendor "Phpgurukul" for product "Online Notes Sharing System" and version "1.0"
-
Affected