Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-6199
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Book Stack v23.10.2 - LFR via Blind SSRF
Source: NVD (National Vulnerability Database)
Vulnerability Description
Book Stack version 23.10.2 allows filtering local files on the server. This is possible because the application is vulnerable to SSRF.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
BookStack 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
BookStack是BookStack公司的一个简单、自托管、易于使用的平台。用于组织和存储信息。 BookStack 23.10.2版本存在代码问题漏洞，该漏洞源于允许过滤服务器上的本地文，导致应用程序容易受到 SSRF 的攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
VendorProductAffected VersionsCPESubscribe
BookStackBookStack 23.10.2 -
II. Public POCs for CVE-2023-6199
#POC DescriptionSource LinkShenlong Link
1A CLI to exploit parameters vulnerable to PHP filter chain error based oracle, modified to exploit CVE-2023-6199https://github.com/AbdrrahimDahmani/php_filter_chains_oracle_exploit_for_CVE-2023-6199POC Details
2PoC scripts to exploit LFR (Local File Read) via PHP filters chain oracle (php://filter), especially for CTF purposes or the exploit of CVE-2023-6199, etc. This's a one-script exploitation PoC modified from https://github.com/synacktiv/php_filter_chains_oracle_exploithttps://github.com/4xura/php_filter_chain_oracle_pocPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2023-6199
Please Login to view more intelligence information
IV. Related Vulnerabilities
Same product: BookStack
Same vendor: BookStack
Same weakness: CWE-918
V. Comments for CVE-2023-6199

No comments yet

Leave a comment