Critical severity · published Dec 17, 2023
CVE-2023-6887
A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
A vulnerability classified as critical has been found in saysky ForestBlog up to 20220630. This affects an unknown part of the file /admin/upload/img of the component Image Upload Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248247.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Forestblog · Forestblog Project
through 2022-06-30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6887
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6887
Exploit
https://github.com/daydust/vuln/blob/main/ForestBlog/Arbitrary_File_Upload_Vulnerability.md
Permissions Required
https://vuldb.com/?ctiid.248247
Third Party Advisory
https://vuldb.com/?id.248247
More from Forestblog
9.8
CVE-2021-46033
In ForestBlog, as of 2021-12-28, File upload can bypass verification
8.8
CVE-2020-18964
Cross Site Request Forgery (CSRF) Vulnerability in ForestBlog latest version via the website Management background, which could let a remote malicious gain privileges
6.1
CVE-2022-29020
ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar
6.1
CVE-2021-46034
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box
5.4
CVE-2025-3005
Sayski ForestBlog Friend Link cross site scripting