cve/2023/CVE-2023-47129.md

### [CVE-2023-47129](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47129)
![](https://img.shields.io/static/v1?label=Product&message=cms&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%203.4.13%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%3A%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brighgreen)

### Description

Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/Cyber-Wo0dy/CVE-2023-47129
- https://github.com/nomi-sec/PoC-in-GitHub