CVE-2023-5966— Unrestricted Upload of File with Dangerous Type in EspoCRM
Quick assessment
Affected
EspoCRM EspoCRM
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EspoCRM是一套开源的基于Web的客户关系管理系统（CRM）。该系统提供销售自动化、社区和客户支持等功能。 EspoCRM 7.2.5 版本存在代码问题漏洞，该漏洞源于存在任意 PHP 代码执行。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-5966
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unrestricted Upload of File with Dangerous Type in EspoCRM
Source: CVE Program / CVE List V5
Vulnerability Description
An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which could lead to arbitrary PHP code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5
Vulnerability Title
EspoCRM 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
EspoCRM是一套开源的基于Web的客户关系管理系统（CRM）。该系统提供销售自动化、社区和客户支持等功能。 EspoCRM 7.2.5 版本存在代码问题漏洞，该漏洞源于存在任意 PHP 代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-5966
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/pedrojosenavasperez/cve-2023-5966 | POC Details |
| 2 | None | https://github.com/ll104567/cve-2023-5966 | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-5966
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: EspoCRM
-
CVE-2026-105833
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Expos -
CVE-2026-105831
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection -
CVE-2026-105832
EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Un -
CVE-2026-92298
EspoCRM through 10.0.8 Weak Token Generation via rand() -
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attend
Same vendor: EspoCRM
-
CVE-2026-105833
EspoCRM before 10.0.5 IDOR via PersonalAccount Service Expos -
CVE-2026-105831
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection -
CVE-2026-105832
EspoCRM before 10.0.6 Two-Factor Authentication Bypass on Un -
CVE-2026-92298
EspoCRM through 10.0.8 Weak Token Generation via rand() -
CVE-2026-90934
EspoCRM before 10.0.4 Field-level Security Bypass via Attend
Same weakness: CWE-434
-
CVE-2026-91844
Remote Code Execution via Unrestricted File Upload in İzomet -
CVE-2026-85097
Bricksforge <= 3.1.8.9 - Unauthenticated Arbitrary File Uplo -
CVE-2026-17609
Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory -
CVE-2026-17196
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitra -
CVE-2026-92532
Unrestricted Upload of File with Dangerous Type in BugTracke
V. Comments for CVE-2023-5966
No comments yet