{"id":"CVE-2023-5796","state":"PUBLISHED","title":"CodeAstro POS System Logo setting unrestricted upload","description":"A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243602 is the identifier assigned to this vulnerability.","publishedAt":"2023-10-26T17:31:05.052Z","updatedAt":"2024-09-09T16:19:02.349Z","severity":{"score":6.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","source":"VulDB"},"assigner":"VulDB","products":["CodeAstro POS System"],"affected":[{"vendor":"CodeAstro","product":"POS System","versions":[{"version":"1.0","status":"affected"}],"modules":["Logo Handler"]}],"references":["https://vuldb.com/?id.243602","https://vuldb.com/?ctiid.243602","https://drive.google.com/file/d/1LIXuVmxby4QTY7v7dD-F0oRnwVVOwlmJ/view?usp=sharing"],"weaknesses":["CWE-434"],"ingestedAt":"2026-10-29T20:06:42.242Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/5xxx/CVE-2023-5796.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-5796","state":"PUBLISHED","datePublished":"2023-10-26T17:31:05.052Z","dateUpdated":"2024-09-09T16:19:02.349Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2023-10-26T07:32:25.905Z"},"containers":{"cna":{"title":"CodeAstro POS System Logo setting unrestricted upload","descriptions":[{"lang":"en","value":"A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting of the component Logo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-243602 is the identifier assigned to this vulnerability."},{"lang":"de","value":"Eine kritische Schwachstelle wurde in CodeAstro POS System 1.0 ausgemacht. Dies betrifft einen unbekannten Teil der Datei /setting der Komponente Logo Handler. Durch das Manipulieren mit unbekannten Daten kann eine unrestricted upload-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"CodeAstro","product":"POS System","versions":[{"version":"1.0","status":"affected"}],"modules":["Logo Handler"]}],"references":[{"url":"https://vuldb.com/?id.243602","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.243602","tags":["signature","permissions-required"]},{"url":"https://drive.google.com/file/d/1LIXuVmxby4QTY7v7dD-F0oRnwVVOwlmJ/view?usp=sharing","tags":["exploit"]}],"metrics":[{"cvssV3_1":{"version":"3.1","baseScore":6.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":6.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":6.5,"vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-434","type":"CWE","lang":"en","description":"CWE-434 Unrestricted Upload"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2023-10-26T17:31:05.052Z"},"timeline":[{"time":"2023-10-26T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2023-10-26T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2023-10-26T09:37:44.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"w3bspl01t3r (VulDB User)","type":"analyst"}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://vuldb.com/?id.243602","tags":["vdb-entry","x_transferred"]},{"url":"https://vuldb.com/?ctiid.243602","tags":["signature","permissions-required","x_transferred"]},{"url":"https://drive.google.com/file/d/1LIXuVmxby4QTY7v7dD-F0oRnwVVOwlmJ/view?usp=sharing","tags":["exploit","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T08:14:24.068Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-09T16:18:46.349666Z","id":"CVE-2023-5796","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-09T16:19:02.349Z"}}]}}}