TI-2023-26007 Aliases CVE-2023-48029 GHSA-674m-h5xx-v6gp

Corebos 8.0 and below is vulnerable to CSV Injection.

HIGH 70CWE-1236Published 2023-11-17 · Updated 2025-09-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution of the malicious payload on the administrator's computer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01285 70th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:corebos:corebos::::::::	up to 8.0	Vulnerable	Corebos

cpe:2.3:a:corebos:corebos:*:*:*:*:*:*:*:* Versions up to 8.0 Vulnerable ·Corebos

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-48029
2026-10-03 Alias added: GHSA-674m-h5xx-v6gp

References

Exploit 1

https://nitipoom-jar.github.io/CVE-2023-48029/

Other 2

TI-2022-04063 PHP Remote File Inclusion in tsolucio/corebos CVSS 3.1CRITICAL 9.8
TI-2023-02880 Cross-site Scripting (XSS) - Stored in tsolucio/corebos CVSS 3.1MEDIUM 5.4
TI-2023-02879 Cross-site Scripting (XSS) - Stored in tsolucio/corebos CVSS 3.1MEDIUM 5.4
TI-2023-02876 Cross-site Scripting (XSS) - Stored in tsolucio/corebos CVSS 3.1MEDIUM 5.4
TI-2023-01441 Cross-site Scripting (XSS) - Generic in tsolucio/corebos CVSS 3.1MEDIUM 5.4
TI-2023-02875 Unverified Password Change in tsolucio/corebos CVSS 3.1CRITICAL 9.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences