CVE-2023-40504
CRITICAL NUCLEILG Simple Editor Command Injection (CVE-2023-40504)
Title source: metasploitExploitation Summary
EIP tracks 1 public exploit for CVE-2023-40504.
PoCs published by rgod, Michael Heinzl, including Metasploit module exploits/windows/http/lg_simple_editor_rce_uploadvideo.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated command injection vulnerability in LG Simple Editor <= v3.21.0. It crafts a malicious multipart form upload to execute arbitrary commands in the context of NT AUTHORITY\SYSTEM.
Description
LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the readVideoInfo method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. . Was ZDI-CAN-19953.
Exploits (1)
This Metasploit module exploits an unauthenticated command injection vulnerability in LG Simple Editor <= v3.21.0. It crafts a malicious multipart form upload to execute arbitrary commands in the context of NT AUTHORITY\SYSTEM.
Nuclei Templates (1)
icon_hash="159985907"
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H