CVE-2023-3852 - CVE House

Back to Database

Status published Medium CVE-2023-3852

OpenRapid RapidCMS upload.php unrestricted upload

4.7 CVSS

Vulnerability Description

A vulnerability was found in OpenRapid RapidCMS up to 1.3.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/upload.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-235204.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-3852

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

TXPH (VulDB User)

References

More from OpenRapid

View All →

OpenRapid RapidCMS runlogon.php sql injection

OpenRapid RapidCMS user-move-run.php sql injection

OpenRapid RapidCMS uploadicon.php isImg unrestricted upload

OpenRapid RapidCMS addgood.php sql injection

OpenRapid RapidCMS cate-edit-run.php sql injection

Affected Vendor

OpenRapid

View all reports →

Affected Software

RapidCMS

Vulnerable Versions:

1.3.0, 1.3.1

Timeline

Official Publish: July 23rd, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation