CVE-2023-46865

/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image.

CVSS v3.1

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

20.32% chance of exploitation in the next 30 days, 97th percentile

Published

2023-10-30

Updated

2024-08-02

Proof-of-concept exploits (2)

• crater-invoice/crater/issues/1267
• asylumdx/Crater-CVE-2023-46865-RCE4★ · 2023-11-10

References

• CVE Record
• NVD entry

Related

• CVE-2023-46864
• CVE-2023-46866
• CVE-2023-46858
• CVE-2023-46867
• CVE-2023-4683
• CVE-2023-4687