CVE-2023-24735

MEDIUMNuclei

PMB 7.4.6 - Open Redirect

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-24735 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMPMB 7.4.6 - Open RedirectCVSS 6.1

PMB v7.4.6 contains an open redirect vulnerability via the component /opac_css/pmb.php. An attacker can redirect a user to an external domain via a crafted URL and thereby potentially obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to phishing attacks or the installation of malware.

Remediation

Upgrade PMB to a version that has addressed the open redirect vulnerability (CVE-2023-24735).

WeaknessesCWE-601
Authorsr3Y3r53
Template tagscve2023cveredirectpmbpmb_projectsigbvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:sigb:pmb:7.4.6:*:*:*:*:*:*:*
Shodan: http.favicon.hash:1469328760
Shodan: http.html:"pmb group"
FOFA: body="pmb group"
FOFA: icon_hash=1469328760
https://github.com/AetherBlack/CVE/blob/main/PMB/readme.md https://github.com/AetherBlack/CVE/tree/main/PMB https://nvd.nist.gov/vuln/detail/CVE-2023-24735

Source: ProjectDiscovery

References

2