CVE-2023-5965

MEDIUM

Espocrm < 7.5.2 - Unrestricted File Upload

Title source: rule

Description

An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution.

Exploits (1)

nomisec WORKING POC

by josemlwdf · poc

https://github.com/josemlwdf/CVE-2023-5965

View Code ZIP pw:eip

References (1)

Core 1

Core References

Third Party Advisory

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-espocrm

Scores

CVSS v3 4.7

EPSS 0.0048

EPSS Percentile 65.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-434

Status published

Products (2)

espocrm/espocrm < 7.5.2

EspoCRM/EspoCRM < 7.5.2

Published Nov 30, 2023

Tracked Since Feb 18, 2026