BaseFortify

Publication date: 2025-12-17

Last updated on: 2025-12-18

Assigner: VulnCheck

Description

UliCMS 2023.1-sniffing-vicuna contains a remote code execution vulnerability that allows authenticated attackers to upload PHP files with .phar extension during profile avatar upload. Attackers can trigger code execution by visiting the uploaded file's location, enabling system command execution through maliciously crafted avatar uploads.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2025-12-18

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2023-53924

EUVD

EUVD-2023-60207

Affected Vendors & Products

Vendor	Product	Version / Range
ulicms	ulicms	2023.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-434	The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

Executive Summary

This vulnerability in UliCMS 2023.1-sniffing-vicuna allows authenticated attackers to upload PHP files disguised with a .phar extension during the profile avatar upload process. By visiting the location of the uploaded file, attackers can execute system commands remotely, leading to remote code execution on the server.

Impact Analysis

The vulnerability can lead to remote code execution on the affected system, allowing attackers to run arbitrary system commands. This can compromise the server's integrity, confidentiality, and availability, potentially leading to data breaches, unauthorized access, and full system compromise.

Hi! I’m here to help you understand CVE-2023-53924. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70