Vulnerability Description
An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpfox | Phpfox | < 4.8.13 |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2023/Oct/30ExploitMailing ListThird Party Advisory
- https://docs.phpfox.com/display/FOX4MAN/phpFox+4.8.14Product
- https://karmainsecurity.com/KIS-2023-12Third Party Advisory
- https://karmainsecurity.com/pocs/CVE-2023-46817.phpExploitThird Party Advisory
- https://www.phpfox.com/blog/Product
- http://seclists.org/fulldisclosure/2023/Oct/30ExploitMailing ListThird Party Advisory
- https://docs.phpfox.com/display/FOX4MAN/phpFox+4.8.14Product
- https://karmainsecurity.com/KIS-2023-12Third Party Advisory
- https://karmainsecurity.com/pocs/CVE-2023-46817.phpExploitThird Party Advisory
- https://www.phpfox.com/blog/Product
FAQ
What is CVE-2023-46817?
CVE-2023-46817 is a vulnerability with a CVSS score of 9.8 (CRITICAL). An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. T...
How severe is CVE-2023-46817?
CVE-2023-46817 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-46817?
Check the references section above for vendor advisories and patch information. Affected products include: Phpfox Phpfox.