CVE-2023-23607
erohtar/Dasherr is a dashboard for self-hosted services. In affected versions unrestricted file upload allows any unauthenticated user to execute arbitrary code on the server. The file /www/include/filesave.php allows for any file to uploaded to anywhere. If an attacker uploads a php file they can execute code on the server. This issue has been addressed in version 1.05.00. Users are advised to upgrade. There are no known workarounds for this issue.
- Score
- CVSS 3.1 9.8 Critical
- Status
- Modified - security-advisories@github.com
- Published
- 2023-01-20
- Last modified
- 2025-03-10
- Weaknesses
- CWE-434
Affected products
References
- https://github.com/erohtar/Dasherr/commit/445325c7cf1148a8cd38af3a90789c6cbf6c5112
- https://github.com/erohtar/Dasherr/security/advisories/GHSA-6rgc-2x44-7phq
- https://www.vicarius.io/vsociety/posts/analyzing-arbitrary-file-upload-in-dasherr-cve-2023-23607-23608
