CVE-2023-3607 kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection

What is CVE-2023-3607?

CVE-2023-3607 is a medium-severity command injection vulnerability in kodbox, published on 10 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Weakness: CWE-78

Which versions are affected by CVE-2023-3607?

It affects 1 product.

Products include Kodcloud Kodbox.

How do I fix CVE-2023-3607?

No fix has been published for CVE-2023-3607 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2023-3607 being exploited?

There is no known exploitation of CVE-2023-3607 in the wild and no public exploit code.

Other vulnerabilities in kodbox

• CVE-2023-39691 Missing authorization in n/a Critical 9.8
• CVE-2023-48028 Information disclosure in n/a Critical 9.8
• CVE-2023-29790 Information disclosure in n/a High 7.5
• CVE-2023-6848 kalcaddle kodbox index.class.php check command injection High 7.3
• CVE-2023-6849 kalcaddle kodbox app.php cover server-side request forgery High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v3cq-v27f-j822.