CVE-2023-1826

published 2023-04-04

CVE-2023-1826: A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file…

Priority P2 64 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file php-ocls\admin\system_info\index.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-224841 was assigned to this vulnerability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
oretnom23	online_computer_and_laptop_store	—	—
sourcecodester	online_computer_and_laptop_store	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /classes/SystemSettings.php?f=update_settings↗

path /uploads/↗

path php-ocls\admin\system_info\index.php↗

command GET {fileUrl}?cmd={command}↗

filename *.php (uuid4-named webshell, e.g. <uuid>.php)↗

• → Detect POST requests to /classes/SystemSettings.php?f=update_settings containing a multipart file upload with a .php extension in the 'img' parameter field name. ↗
• → Detect GET requests to /uploads/ for files matching the pattern <epoch_timestamp>_<uuid>.php, which indicates access to a freshly uploaded PHP webshell. ↗
• → Detect GET requests to /uploads/*.php containing a 'cmd' query parameter, indicating webshell command execution. ↗
• → The uploaded webshell content is a PHP passthru/system one-liner; monitor for PHP files written to the /uploads/ directory on the web server filesystem. ↗

• · The exploit calculates the uploaded filename using UTC epoch time rounded to the nearest minute, meaning the window for filename prediction is up to 60 seconds. Detection logic should account for this time-based naming scheme. ↗
• · The vulnerability is in the 'img' parameter of the system settings update endpoint; no authentication bypass is described, so the attacker may need valid admin credentials or the admin panel may be exposed without authentication. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434