CVE-2023-49544

A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via manipulation of the page= parameter at /customer_support/index.php.

CVSS v3.1 CNA

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS

0.73% chance of exploitation in the next 30 days, 54th percentile

Published

2024-03-01

Updated

2024-08-02

Proof-of-concept exploits (1)

• geraldoalcantara/CVE-2023-495440★ · 2023-12-19

Security advisories

• https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-c…

References

• CVE Record
• NVD entry

Related

• CVE-2023-49539
• CVE-2023-49540
• CVE-2023-49543
• CVE-2023-49545
• CVE-2023-49546
• CVE-2023-49547