CVE-2023-2523

published 2023-05-04

CVE-2023-2523: A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file…

Priority P1 86 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

A vulnerability was found in Weaver E-Office 9.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file App/Ajax/ajax.php?action=mobile_upload_save. The manipulation of the argument upload_quwan leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-228014 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
e-office	e-office	—	—
weaver	e-office	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /App/Ajax/ajax.php?action=mobile_upload_save↗

path /inc/jquery/uploadify/uploadify.php↗

filename {{file}}.php.

command POST /inc/jquery/uploadify/uploadify.php HTTP/1.1

other app="泛微-EOffice"

other app="泛微-eoffice"

• → Exploit targets unrestricted file upload via the 'upload_quwan' argument at App/Ajax/ajax.php?action=mobile_upload_save, allowing remote code execution on Weaver E-Office 9.5. ↗
• → Exploit targets unrestricted file upload via the 'Filedata' argument at /inc/jquery/uploadify/uploadify.php; attacker uploads a PHP webshell with a trailing dot in the filename (e.g., shell.php.) to bypass extension filters.
• → Detection: Monitor for multipart/form-data POST requests to /inc/jquery/uploadify/uploadify.php with a filename parameter containing a .php extension (including trailing-dot bypass variants such as .php.).
• → After upload, attacker issues a second POST to the uploaded PHP file path under /attachment/ to achieve remote code execution; monitor for POST requests to /attachment/<numeric_dir>/*.php.
• → FOFA fingerprint queries 'app="泛微-EOffice"' and 'app="泛微-eoffice"' can be used to identify exposed Weaver E-Office instances on the internet.
• → The exploit is publicly disclosed and PoC code is available at https://github.com/bingtangbanli/cve-2023-2523-and-cve-2023-2648; treat any access to this repo as a threat-intel signal.

• · The Nuclei template provided covers CVE-2023-2648 (uploadify.php vector), not CVE-2023-2523 (ajax.php mobile_upload_save vector). Ensure separate detection coverage is built for the ajax.php endpoint.
• · The filename bypass technique uses a trailing dot (e.g., 'shell.php.') to evade extension-based upload filters; detection rules must account for this variant and not rely solely on exact .php extension matching.
• · The vulnerability is exploitable with no authentication (PR:N, UI:N) and has a CVSS score of 9.8; network-level blocking of the vulnerable endpoints is strongly advised until patching is possible.
• · EPSS score of 0.92555 (99.74th percentile) indicates very high probability of exploitation in the wild; prioritize detection and patching accordingly.

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

vendor_redhat 5.5 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434 CWE-190