CVE-2023-53872
CVE-2023-53872
9.3
CriticalPublished:
Last updated:
Source:disclosure@vulncheck.com
Deferred
Weakness (CWE)
CVSS Vector
v4.0- Attack Vector
- Network
- Attack Complexity
- Low
- Attack Requirements
- None
- Privileges Required
- None
- User Interaction
- None
- Confidentiality (Vulnerable)
- High
- Integrity (Vulnerable)
- High
- Availability (Vulnerable)
- High
- Confidentiality (Subsequent)
- None
- Integrity (Subsequent)
- None
- Availability (Subsequent)
- None
Description
Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.
References
disclosure@vulncheck.com
https://github.com/metinyesil/wp2facdisclosure@vulncheck.com
https://www.exploit-db.com/exploits/51717disclosure@vulncheck.com
https://www.vulncheck.com/advisories/wpfac-os-command-injection-via-sendphp-endpoint