CVE-2023-3767 OS command injection on EasyPHP Webserver
An attacker can execute arbitrary OS commands on EasyPHP Webserver via a crafted request to the settings parameter, gaining full system access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3767?
CVE-2023-3767 is a critical command injection vulnerability in EasyPHP Webserver, published on 26 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An OS command injection vulnerability has been found on EasyPHP Webserver affecting version 14.1. This vulnerability could allow an attacker to get full access to the system by sending a specially crafted exploit to the /index.php?zone=settings parameter.
Weakness: CWE-78
Which versions are affected by CVE-2023-3767?
It affects 1 product.
Products include Easyphp Webserver.
How do I fix CVE-2023-3767?
No fix has been published for CVE-2023-3767 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-3767 being exploited?
There is no known exploitation of CVE-2023-3767 in the wild and no public exploit code.
Other vulnerabilities in EasyPHP Webserver
Sources
Also known as GHSA-2v7x-3r8r-xgw9.