CSKefu File Upload Function Allows Remote Code Execution

Summary

A security weakness in CSKefu's file upload feature allows an attacker to inject malicious code, potentially causing harm to your website or customers. This weakness can be exploited remotely, so it's essential to update CSKefu to the latest version (8.0.1 or later) to fix the issue.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
cskefu	cskefu	<= 8.0.1	–

Original title

A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the component File Upload. The manipulation...

Original description

A vulnerability was detected in cskefu up to 8.0.1. Impacted is the function Upload of the file com/cskefu/cc/controller/resource/MediaController.java of the component File Upload. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 4.0

nvd CVSS3.1 5.4

nvd CVSS4.0 5.1

Vulnerability type

CWE-79 Cross-site Scripting (XSS)

CWE-94 Code Injection

https://fx4tqqfvdw4.feishu.cn/docx/ZqvtdTniToQMw0xZL94cTpuTnac Exploit Third Party Advisory
https://vuldb.com/?ctiid.346165 Permissions Required VDB Entry
https://vuldb.com/?id.346165 Third Party Advisory VDB Entry
https://vuldb.com/?submit.750729 Third Party Advisory VDB Entry