CVE-2013-10037 WebTester 5.x install2.php Unauthenticated Command Execution
Remote attackers can execute arbitrary commands via unsanitized parameters in the WebTester installation script, requiring the installer to be accessible.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-10037?
CVE-2013-10037 is a critical command injection vulnerability in Eppler Software WebTester, published on 31 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.
Weakness: CWE-78
Which versions are affected by CVE-2013-10037?
How do I fix CVE-2013-10037?
No fix has been published for CVE-2013-10037 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2013-10037 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-10037 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-3w97-v426-7jw9.