CVE-2023-23328
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file. This vulnerability affects AvantFAX version 3.3.7.
Risk Assessment
An attacker can upload a malicious PHP file to the server, potentially leading to remote code execution, system compromise, or data theft.
Recommendation
Immediately update AvantFAX to the latest available version and implement additional file upload validation mechanisms, such as checking file extension and content.
Other vulnerabilities in AvantFAX
See all- CVE-2023-23327Medium
An information disclosure vulnerability exists in AvantFAX 3.3.7. Backups of sent/received faxes and database backups are stored with the current date as the filename and hosted on the web server without access controls.
- CVE-2023-23326Medium
A stored Cross-Site Scripting (XSS) vulnerability in AvantFAX 3.3.7 allows an authenticated low-privilege user to inject arbitrary JavaScript into their email address, which executes when an administrator views the admin dashboard.
Original NVD description (English source)
A File Upload vulnerability exists in AvantFAX 3.3.7. An authenticated user can bypass PHP file type validation in FileUpload.php by uploading a specially crafted PHP file.