CVE-2023-3057
MediumCVSS 4.3Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
A vulnerability was found in YFCMF up to 3.0.4, allowing path traversal attacks through manipulation of the controllername argument in app/admin/controller/Ajax.php.
Risk Assessment
An attacker may exploit this vulnerability remotely, potentially leading to unauthorized access to system files.
Recommendation
It is recommended to update YFCMF to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app/admin/controller/Ajax.php. The manipulation of the argument controllername leads to path traversal: '../filedir'. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230543.