CVE-2023-2523
HIGH EXPLOITEDWeaver E-Office 9.5 - Unrestricted Upload of File with Dangerous Type via upload_quwan Parameter
Title source: llmExploitation Summary
CVE-2023-2523 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Any3ite, werwolfz.
AI-analyzed exploit summary This Go-based exploit targets CVE-2023-2523 in Weaver E-Office9 by uploading a malicious PHP file via a vulnerable endpoint (`/E-mobile/App/Ajax/ajax.php?action=mobile_upload_save`). It achieves RCE by embedding a PHP eval payload and triggering it via a crafted HTTP request.
Description
A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228014 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Exploits (3)
This Go-based exploit targets CVE-2023-2523 in Weaver E-Office9 by uploading a malicious PHP file via a vulnerable endpoint (`/E-mobile/App/Ajax/ajax.php?action=mobile_upload_save`). It achieves RCE by embedding a PHP eval payload and triggering it via a crafted HTTP request.
The repository contains functional exploit code for CVE-2023-2523 and CVE-2023-2648, demonstrating file upload vulnerabilities in E-mobile and uploadify.php respectively. The scripts upload PHP files with embedded PHP code (e.g., phpinfo()) to achieve remote code execution.
This repository contains a functional exploit for CVE-2023-2523, targeting a file upload vulnerability in Weaver E-Mobile. The PoC demonstrates arbitrary file upload via a multipart form request to '/E-mobile/App/Ajax/ajax.php?action=mobile_upload_save'.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L