CVE-2023-53981

Description

PhotoShow 3.0 contains a remote code execution vulnerability that allows authenticated administrators to inject malicious commands through the exiftran path configuration. Attackers can exploit the ffmpeg configuration settings by base64 encoding a reverse shell command and executing it through a crafted video upload process.

Weakness classification

• disclosure@vulncheck.com: CWE-78
• nvd@nist.gov: CWE-78

Primary references

• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory