CVE-2023-48966: Malicious File Upload
Published Dec 4, 2023
·Updated
An arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53 allows attackers to execute arbitrary code via a crafted Zip file.
Affected Software
2 affected components
composer/zoujingli/thinkadmin<=6.1.53
ThinkAdmin ThinkAdmin=6.1.53
Event History
Dec 4, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Advisory Published
06:30 PM
Frequently Asked Questions
1
What is CVE-2023-48966?
CVE-2023-48966 is an arbitrary file upload vulnerability in the component /admin/api.upload/file of ThinkAdmin v6.1.53.
2
How can attackers exploit CVE-2023-48966?
Attackers can exploit CVE-2023-48966 by uploading a crafted Zip file, allowing them to execute arbitrary code.
3
What is the severity of CVE-2023-48966?
CVE-2023-48966 has a severity level of 8.8 (high).
4
What is the affected software for CVE-2023-48966?
The affected software for CVE-2023-48966 is ThinkAdmin v6.1.53.
5
How do I fix CVE-2023-48966?
To fix CVE-2023-48966, update ThinkAdmin to a version that is not affected by the vulnerability.