CVE-2023-3235
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A critical vulnerability was found in mccms versions up to 2.6.5 in the pic_api function of the file sys/apps/controllers/admin/Comic.php. Manipulation of the url argument leads to server-side request forgery.
Risk Assessment
An attacker can remotely exploit this vulnerability, potentially leading to unauthorized access to server resources. The public disclosure of the exploit increases the risk of an attack.
Recommendation
It is recommended to update mccms to the latest version to eliminate this vulnerability. Additionally, server logs should be monitored for suspicious activity.
Original NVD description (English source)
A vulnerability was found in mccms up to 2.6.5. It has been rated as critical. Affected by this issue is the function pic_api of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument url leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-231506 is the identifier assigned to this vulnerability.