CVE-2023-5185
📋 TL;DR
Gym Management System Project v1.0 has an insecure file upload vulnerability that allows authenticated attackers to upload malicious files and execute arbitrary code on the server. This affects all deployments of this specific software version.
💻 Affected Systems
- Gym Management System Project
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing data theft, ransomware deployment, or use as attack platform
Likely Case
Webshell installation leading to data exfiltration and lateral movement
If Mitigated
Limited impact with proper file upload restrictions and server hardening
🎯 Exploit Status
Exploit requires authentication but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://projectworlds.in/
Restart Required: No
Instructions:
No official patch available. Consider replacing with alternative software or implementing workarounds.
🔧 Temporary Workarounds
File Upload Restriction
allRestrict file uploads to specific extensions and implement server-side validation
Modify profile/i.php to validate file extensions and MIME types
Web Application Firewall
allDeploy WAF rules to block malicious file uploads
Configure WAF to block uploads of executable files to profile/i.php
🧯 If You Can't Patch
- Remove or disable the profile/i.php upload functionality
- Implement strict network segmentation and monitor for suspicious file uploads
🔍 How to Verify
Check if Vulnerable:
Check if Gym Management System Project v1.0 is installed and accessible at profile/i.php with file upload capabilityCheck Version:
Check application version in admin panel or source codeVerify Fix Applied:
Attempt to upload a malicious file (e.g., .php shell) and verify it's blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to profile/i.php
- PHP file execution from upload directory
Network Indicators:
- POST requests to profile/i.php with file uploads
- Subsequent requests to uploaded files
SIEM Query:
source="web_logs" AND uri="/profile/i.php" AND method="POST" AND file_upload="true"