CVE-2023-5241criticalCWE-22

CVE-2023-5241: falha crítica em quantumcloud WPBot – AI ChatBot for Live…

AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

48Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 9.6epss 2.6%
The AI ChatBot for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.8.9 as well as 4.9.2 via the qcld_openai_upload_pagetraining_file function. This allows subscriber-level attackers to append "<?php" to any existing file on the server resulting in potential DoS when appended to critical files such as wp-config.php.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Produtos afetados
quantumcloud · WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — quantumcloud WPBot – AI ChatBot for Live…

No mesmo produto, das mais perigosas para as menos.

CVE-2023-5204CRITICALAI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_responseEPSS 7.8%CVE-2023-5212CRITICALAI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_fileEPSS 2.0%CVE-2023-5254MEDIUMAI ChatBot <= 4.8.9 - Unauthenticated Sensitive Information Exposure via qcld_wb_chatbot_check_userEPSS 0.9%CVE-2026-13731HIGHWPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.9%CVE-2023-5533MEDIUMAI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actionsEPSS 0.6%CVE-2026-83593HIGHWPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' ParameterEPSS 0.5%