CVE-2023-3236
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A critical vulnerability has been found in mccms up to version 2.6.5, affecting the pic_save function in the file sys/apps/controllers/admin/Comic.php. Manipulation of the pic argument leads to server-side request forgery, which can be initiated remotely.
Risk Assessment
This vulnerability poses a serious risk to organizations by allowing remote attacks, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to update mccms to the latest version to mitigate this vulnerability and to monitor the system for unauthorized activities.
Original NVD description (English source)
A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507.