Exploitation Summary
EIP tracks 1 public exploit for CVE-2023-6654. PoCs published by qfmy1024.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-6654, a PHPEMS Cookie deserialization vulnerability. The exploit leverages a deserialization flaw to modify SQL queries, allowing password or privilege changes for arbitrary users.
Description
A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability.
Exploits (1)
This repository contains a functional exploit for CVE-2023-6654, a PHPEMS Cookie deserialization vulnerability. The exploit leverages a deserialization flaw to modify SQL queries, allowing password or privilege changes for arbitrary users.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L