PT-2023-28829 · Unknown · Service Provider Management System

Samarth Dad

·

CVE-2023-43457

·

Published

2023-09-25

·

Updated

2024-09-25

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Service Provider Management System version 1.0
Description An issue in the system allows a remote attacker to gain privileges via the ID parameter in the "/php-spms/admin/?page=user/" endpoint.
Recommendations For version 1.0, consider disabling access to the "/php-spms/admin/?page=user/" endpoint until a patch is available. Restrict the use of the ID parameter in this endpoint to minimize the risk of exploitation.

Exploit

Fix

Improper Privilege Management

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-43457

Affected Products

Service Provider Management System