admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-05-05 18:27:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2023/CVE-2023-1720.md
0xMarcio 48a00929ac Removed duplicates
2024-06-18 02:51:15 +02:00

891 B
Raw Permalink Blame History

CVE-2023-1720

Description

Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.

POC

Reference

Github

No PoCs found on GitHub currently.