CVE-2023-24836

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary directories to perform arbitrary system operation or disrupt service.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
SUNNET	CTMS	7.0 1227

References

https://www.twcert.org.tw/tw/cp-132-7033-878ab-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7033-878ab-1.htmlThird Party Advisory

Timeline

Published: Apr 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-248378.8HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user CVE-2023-248389.8HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain t CVE-2023-248396.1HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulner CVE-2023-24844.9The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in vers CVE-2023-248407.2HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with ad CVE-2023-248417.2HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote a CVE-2023-248425.3HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to access CVE-2023-248437.5Transient DOS in Modem while triggering a camping on an 5G cell.CVE-2023-248447.8Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.CVE-2023-248459.8A vulnerability has been identified in RUGGEDCOM i800, RUGGEDCOM i800NC, RUGGEDCOM i801, RUGGEDCOM i801NC, RUGGEDCOM i802, RUGGEDCOM i802NC,CVE-2023-248477.5Transient DOS in Modem while allocating DSM items.CVE-2023-248487.5Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.