Loading story…
STAR Labs disclosed three Bitrix24 vulnerabilities affecting version 22.0.300 that can expose data and enable code execution. CVE-2023-1715 and CVE-2023-1716 affect the CRM invoice edit page, where improper sanitization of the USER_DESCRIPTION field allows a stored XSS payload to be saved and triggered when a user opens the invoice. The bypass relies on flawed handling of input beginning with < and JavaScript escaping weaknesses involving the Unicode paragraph separator U+2029. Exploitation requires an authenticated user with CRM access and invoice edit permissions, and successful compromise of an administrator can lead to abuse of Bitrix24’s built-in PHP Command Line feature to run arbitrary PHP or system commands on the server.
A separate flaw, CVE-2023-1719, stems from insecure global variable extraction in bitrix/modules/main/tools.php and can be exploited without authentication. Researchers said the bug allows attackers to influence uninitialized variables through GET, POST, or Cookie data, enabling both IDOR-based attachment enumeration via /pub/im.file.php and reflected XSS via /bitrix/components/bitrix/socialnetwork.events_dyn/get_message_2.php. The reflected XSS also uses a U+2029 sanitizer bypass and, if executed in an administrator’s browser, can similarly be chained into server-side command execution through the platform’s PHP command functionality.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2023-11-01, STAR Labs SG publicly disclosed CVE-2023-1715, CVE-2023-1716, and CVE-2023-1719 affecting Bitrix24 version 22.0.300. The disclosures described stored and reflected XSS, insecure global variable extraction, unauthenticated attachment enumeration, and possible escalation to arbitrary PHP or system command execution via Bitrix24's PHP Command Line feature.
STAR Labs SG reported the Bitrix24 vulnerabilities to Bitrix in March 2023. The issues included CVE-2023-1715 and CVE-2023-1716, with the advisories indicating a vendor coordination process before public release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs disclosed two high-severity vulnerabilities in Bitrix24 `22.0.300`, including `CVE-2023-1713`, which can lead to remote code execution on Apache-hosted deployments. The RCE issue affects the Instagram import feature, where an authenticated low-privilege user can control the basename of a downloaded file and create a malicious `.htaccess` file in the Bitrix upload directory. Because Apache honors `.htaccess` directives there, an attacker can make uploaded content executable as PHP and gain code execution after locating the randomized temporary subdirectory; researchers said the file can be kept in place long enough for brute-force discovery by slowly streaming data.
Jun 29, 2026
CERT Polska disclosed four vulnerabilities in the Bludit content management system, including an unrestricted file upload flaw tracked as **CVE-2026-25099** that can lead to remote code execution, a stored XSS issue in image upload handling (**CVE-2026-25100**), a session fixation weakness that can enable session hijacking (**CVE-2026-25101**), and a separate stored XSS flaw in page creation tracked as **CVE-2026-4420**. The vulnerabilities were reported by researchers Arkadiusz Marta and Yassin Abdelrazek and affect multiple Bludit versions, with **CVE-2026-25099** impacting all releases before `3.18.4`, **CVE-2026-25101** affecting versions before `3.17.2`, **CVE-2026-25100** affecting all versions through `3.18.2`, and **CVE-2026-4420** confirmed in `3.17.2` and `3.18.0`. The XSS flaws can be exploited by authenticated users with content or page creation privileges by injecting malicious JavaScript into uploaded SVG content or article tags, with payloads executing when victims access publicly reachable resources without authentication. CERT Polska said the page-creation XSS could be used to automatically create a new site administrator if the victim has sufficient privileges, while the file upload issue could allow direct server-side compromise through remote code execution. The agency also said vendor coordination was incomplete, noting the vendor stopped responding or did not provide details on remediation and affected version ranges, raising uncertainty over whether some future releases may remain vulnerable.
Jun 29, 2026
Newly published CVEs detail severe application-layer vulnerabilities in three widely used web platforms. **Shopizer 3.2.5** is affected by `CVE-2026-36767`, a critical path traversal flaw in the `/content/images/add` endpoint that lets an unauthenticated attacker send a crafted POST request and write arbitrary files to any writable path. **JeeSite 5.15.1** is affected by `CVE-2026-36760`, where the `fileMd5` parameter in `/a/file/upload` can be abused during chunked uploads to traverse directories and write arbitrary files with whitelisted suffixes to attacker-chosen filesystem locations; exploitation requires authenticated access with file upload permissions. A separate high-severity issue, `CVE-2026-36340`, affects **Krayin CRM 2.1.5** and allows remote code execution through the compose email function. The flaw was classified as `CWE-94` and has been fixed in **Krayin CRM 2.1.6**. The Shopizer and JeeSite bugs were both classified as `CWE-22` and carry high-impact CVSS ratings reflecting serious risk to confidentiality and integrity, with Shopizer also exposing availability. Public references for all three issues were added alongside their CVE records, including linked GitHub documentation and issue reports describing the vulnerabilities.
Jun 29, 2026