CVE-2023-53933

Description

Serendipity 2.4.0 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP files with .phar extension. Attackers can upload files with system command payloads to the media upload endpoint and execute arbitrary commands on the server.

Weakness classification

• disclosure@vulncheck.com: CWE-434

Primary references

• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory, VDB Entry