CVE-2023-48031

OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions and upload a .bat file by manipulating the file's magic bytes to masquerade as an allowed type. This can enable the attacker to execute arbitrary code or establish a reverse shell, leading to unauthorized file writes or control over the victim's station via a crafted file upload operation.

• CWE-434
• CWE-434

• https://bugplorer.github.io/cve-opensupports/Broken Link
• https://nitipoom-jar.github.io/CVE-2023-48031/Exploit
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48031
• https://bugplorer.github.io/cve-opensupports/Broken Link
• https://nitipoom-jar.github.io/CVE-2023-48031/Exploit

Published

Nov 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-48023Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: t…9.1
• CVE-2023-48024Liblisp through commit 4c65969 was discovered to contain a u…6.5
• CVE-2023-48025Liblisp through commit 4c65969 was discovered to contain a o…8.1
• CVE-2023-48028kodbox 1.46.01 has a security flaw that enables user enumera…9.8
• CVE-2023-48029Corebos 8.0 and below is vulnerable to CSV Injection. An att…8
• CVE-2023-4803A reflected cross-site scripting vulnerability in the WriteW…4.8
• CVE-2023-48034An issue discovered in Acer Wireless Keyboard SK-9662 allows…6.1
• CVE-2023-48039GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memor…5.5
• CVE-2023-4804An unauthorized user could access debug features in Quantum …9.8
• CVE-2023-48042Cross Site Scripting (XSS) in Search filters in Prestashop A…6.1
• CVE-2023-48049A SQL injection vulnerability in Cybrosys Techno Solutions W…9.8
• CVE-2023-4805The Tutor LMS WordPress plugin before 2.3.0 does not sanitis…5.4