CVE-2023-7159 - CVE House

Back to Database

Status published Medium CVE-2023-7159

gopeak MasterLab User.php update unrestricted upload

4.7 CVSS

Vulnerability Description

A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-7159

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

glzjin (VulDB User)

References

More from gopeak

View All →

gopeak MasterLab User.php base64ImageContent unrestricted upload

gopeak MasterLab HTTP POST Request Feature.php sqlInjectDelete sql injection

gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection

gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection

Affected Vendor

gopeak

View all reports →

Affected Software

MasterLab

Vulnerable Versions:

3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 3.3.6, 3.3.7, 3.3.8, 3.3.9, 3.3.10

Timeline

Official Publish: December 29th, 2023

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1059 Command and Scripting Interpreter

T1565.002 Stored Data Manipulation