CVE-2023-46817
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code.
| Vendor | n/a |
| Product | n/a |
| Published | Nov 3, 2023 |
| Last Updated | Sep 6, 2024 |
Stay Ahead of the Next One
Get instant alerts for n/a n/a
Be the first to know when new critical vulnerabilities affecting n/a n/a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n/a / n/a
n/a
References
phpfox.com: https://www.phpfox.com/blog/ seclists.org: http://seclists.org/fulldisclosure/2023/Oct/30 karmainsecurity.com: https://karmainsecurity.com/pocs/CVE-2023-46817.php karmainsecurity.com: https://karmainsecurity.com/KIS-2023-12 docs.phpfox.com: https://docs.phpfox.com/display/FOX4MAN/phpFox+4.8.14