CVE-2023-7147 - CVE House
Back to Database
Status published Medium CVE-2023-7147

gopeak MasterLab User.php base64ImageContent unrestricted upload

Vulnerability Description

A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-7147

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • glzjin (VulDB User)

References

More from gopeak

View All →
CVE-2023-7159
gopeak MasterLab User.php update unrestricted upload
Medium 4.7
CVE-2023-7146
gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection
Medium 6.3
CVE-2023-7145
gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection
Medium 6.3
CVE-2023-7144
gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection
Medium 6.3

Affected Vendor

Affected Software

MasterLab
Vulnerable Versions:
3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.3.10

Timeline

Official Publish: December 29th, 2023
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact