Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-53924. PoCs published by Mirabbas Ağalarov.
AI-analyzed exploit summary This exploit demonstrates an RCE vulnerability in Ulicms 2023.1-sniffing-vicuna by uploading a malicious PHAR file disguised as an avatar, bypassing image processing checks. The payload executes arbitrary commands when accessed via the uploaded file path.
Description
UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution through maliciously crafted avatar uploads.
Exploits (1)
This exploit demonstrates an RCE vulnerability in Ulicms 2023.1-sniffing-vicuna by uploading a malicious PHAR file disguised as an avatar, bypassing image processing checks. The payload executes arbitrary commands when accessed via the uploaded file path.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H