Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2023-38965 — Authorization Bypass Through User-Controlled Key in Lost AND Found Information System

CWE-639 — Authorization Bypass Through User-Controlled Key4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.1%
top 68.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Oretnom23 Lost AND Found Information System
Timeline
PublishedNov 3
Latest updateFeb 13

Description

Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-4h7h-xhv3-2g96: Lost and Found Information System 1↗2023-11-03
▶
CVEList
CVE-2023-38965: Lost and Found Information System 1↗2023-11-03
▶

💥Exploits & PoCs

1
Exploit-DB
Lost and Found Information System v1.0 - ( IDOR ) leads to Account Take over↗2024-02-13
▶
CVE-2023-38965 — CRITICAL severity | cvebase