CVE-2023-3236

A vulnerability classified as critical has been found in mccms up to 2.6.5. This affects the function pic_save of the file sys/apps/controllers/admin/Comic.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231507.

• CWE-918

• https://github.com/HuBenLab/HuBenVulList/blob/main/MCCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF)%202.mdExploit
• https://vuldb.com/?ctiid.231507Permissions Required
• https://vuldb.com/?id.231507Permissions Required
• https://github.com/HuBenLab/HuBenVulList/blob/main/MCCMS%20is%20vulnerable%20to%20Server-side%20request%20forgery%20(SSRF)%202.mdExploit
• https://vuldb.com/?ctiid.231507Permissions Required
• https://vuldb.com/?id.231507Permissions Required

Published

Jun 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32354An out-of-bounds read was addressed with improved input vali…5.5
• CVE-2023-32355A logic issue was addressed with improved state management. …5.5
• CVE-2023-32356A buffer overflow issue was addressed with improved memory h…7.8
• CVE-2023-32357An authorization issue was addressed with improved state man…7.1
• CVE-2023-32358A type confusion issue was addressed with improved checks. T…8.8
• CVE-2023-32359This issue was addressed with improved redaction of sensitiv…7.5
• CVE-2023-32360An authentication issue was addressed with improved state ma…5.5
• CVE-2023-32361The issue was addressed with improved handling of caches. Th…5.5
• CVE-2023-32362Error handling was changed to not reveal sensitive informati…6.5
• CVE-2023-32363A permissions issue was addressed by removing vulnerable cod…5.5
• CVE-2023-32364A logic issue was addressed with improved restrictions. This…8.6
• CVE-2023-32365The issue was addressed with improved checks. This issue is …2.4