CVE-2023-3121

A vulnerability has been found in Dahua Smart Parking Management up to 20230528 and classified as problematic. This vulnerability affects unknown code of the file /ipms/imageConvert/image. The manipulation of the argument fileUrl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-230800. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-918
• CWE-918

• https://github.com/RCEraser/cve/blob/main/DaHua..mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.230800Permissions Required, Third Party Advisory
• https://vuldb.com/?id.230800Third Party Advisory
• https://github.com/RCEraser/cve/blob/main/DaHua..mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.230800Permissions Required, Third Party Advisory
• https://vuldb.com/?id.230800Third Party Advisory

Published

Jun 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31200 PTC Vuforia Studio does not require a token; this could…8
• CVE-2023-31203Improper input validation in some OpenVINO Model Server soft…7.5
• CVE-2023-31206Exposure of Resource to Wrong Sphere Vulnerability in Apache…7.5
• CVE-2023-31207Transmission of credentials within query parameters in Check…5.5
• CVE-2023-31208Improper neutralization of livestatus command delimiters in …8.8
• CVE-2023-31209Improper neutralization of active check command arguments in…8.8
• CVE-2023-31210Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk…7.8
• CVE-2023-31211Insufficient authentication flow in Checkmk before 2.2.0p18,…6.5
• CVE-2023-31212Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-31213Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulne…5.4
• CVE-2023-31214Missing Authorization vulnerability in Arul Prasad J WP Quic…5.4
• CVE-2023-31215Unrestricted Upload of File with Dangerous Type vulnerabilit…8.8