CVE-2013-10035 ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution
Authenticated attackers can execute arbitrary PHP code in ProcessMaker Open Source via crafted requests to specific endpoints in the default skin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-10035?
CVE-2013-10035 is a high-severity code injection vulnerability in ProcessMaker, Inc. ProcessMaker Open Source, published on 31 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.
Weakness: CWE-94
Which versions are affected by CVE-2013-10035?
How do I fix CVE-2013-10035?
No fix has been published for CVE-2013-10035 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2013-10035 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-10035 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-q65g-898q-8jpw.