CVE-2023-28458
MEDIUMPretalx Limited File Write to Remote Code Execution
Title source: metasploitExploitation Summary
EIP tracks 2 public exploits for CVE-2023-28458.
PoCs published by Stefan Schiller, msutovsky-r7, including Metasploit module auxiliary/scanner/http/pretalx_file_read_cve_2023_28459.
AI-analyzed exploit summary This Metasploit module exploits CVE-2023-28459 (arbitrary file read) and CVE-2023-28458 (limited file write) in Pretalx by abusing the schedule export functionality to include arbitrary files via HTML tags. It requires valid credentials and conference details to execute the attack.
Description
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.
Exploits (2)
This Metasploit module exploits CVE-2023-28459 (arbitrary file read) and CVE-2023-28458 (limited file write) in Pretalx by abusing the schedule export functionality to include arbitrary files via HTML tags. It requires valid credentials and conference details to execute the attack.
This Metasploit module exploits CVE-2023-28458, a limited file write vulnerability in Pretalx up to version 2.3.1, to achieve remote code execution by writing a malicious Python configuration hook. The exploit requires debug mode to be enabled and valid credentials.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N