CVE-2023-49545
📋 TL;DR
This directory listing vulnerability in Customer Support System v1 allows unauthenticated attackers to enumerate directories and access sensitive files without authorization. It affects all deployments of Customer Support System v1 that haven't been patched or properly secured.
💻 Affected Systems
- Customer Support System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to sensitive configuration files, database credentials, user data, and other critical information leading to full system compromise.
Likely Case
Attackers enumerate directory structures and access sensitive files containing configuration data, logs, or backup files.
If Mitigated
Unauthorized access attempts are blocked, and directory listings are disabled, preventing information disclosure.
🎯 Exploit Status
Public exploit code available on GitHub, requires only web browser or curl commands
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Apply workarounds or upgrade to a secure version if available.
🔧 Temporary Workarounds
Disable Directory Listing
allConfigure web server to disable directory listing/indexing
For Apache: Add 'Options -Indexes' to .htaccess or httpd.conf
For Nginx: Add 'autoindex off;' to server block
Restrict Access to Sensitive Directories
allBlock access to sensitive directories using web server configuration
For Apache: 'Deny from all' in .htaccess for sensitive directories
For Nginx: 'location /sensitive/ { deny all; }'
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block directory traversal attempts
- Move sensitive files outside web root directory and restrict access via network segmentation
🔍 How to Verify
Check if Vulnerable:
Attempt to access application directories without proper file references (e.g., http://target.com/uploads/) and check if directory listing is displayedCheck Version:
Check application version in admin panel or readme filesVerify Fix Applied:
Attempt same directory access and verify '403 Forbidden' or proper error page appears instead of directory listing📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to directory paths without file extensions
- Access to sensitive directories like /config/, /admin/, /uploads/
Network Indicators:
- HTTP requests ending with trailing slashes or directory names without files
- Pattern of requests trying to enumerate directories
SIEM Query:
http.status_code=200 AND (http.url CONTAINS "/uploads/" OR http.url CONTAINS "/config/") AND NOT http.url CONTAINS ".php"🔗 References
- https://cwe.mitre.org/data/definitions/548.html
- https://github.com/geraldoalcantara/CVE-2023-49545
- https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
- https://cwe.mitre.org/data/definitions/548.html
- https://github.com/geraldoalcantara/CVE-2023-49545
- https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
