CVE-2023-2453 - CVE House
Back to Database
Status published High CVE-2023-2453

Local file Inclusion (LFI) in Forum Infusion via Directory Traversal

Vulnerability Description

There is insufficient sanitization of tainted file names that are directly concatenated with a path that is subsequently passed to a ‘require_once’ statement. This allows arbitrary files with the ‘.php’ extension for which the absolute path is known to be included and executed. There are no known means in PHPFusion through which an attacker can upload and target a ‘.php’ file payload.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-2453

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Matthew Hogg

References

More from PHPFusion

View All →
CVE-2023-4480
Arbitrary File Read in Fusion File Manager
Medium 5.5

Affected Vendor

Affected Software

PHPFusion
Vulnerable Versions:
0

Timeline

Official Publish: September 5th, 2023
Last Modified: September 27th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-829

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.