| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 7 Dec 2023 17:51:54 +0100 From: Egidio Romano <n0b0d13s@...il.com> To: fulldisclosure@...lists.org, submissions@...ketstormsecurity.com Subject: [FD] [KIS-2023-13] ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability ------------------------------------------------------------------------ ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability ------------------------------------------------------------------------ [-] Software Link: https://www.ispconfig.org [-] Affected Versions: Version 3.2.11 and prior versions. [-] Vulnerabilities Description: User input passed through the "records" POST parameter to /admin/language_edit.php is not properly sanitized before being used to dynamically generate PHP code that will be executed by the application. This can be exploited by malicious administrator users to inject and execute arbitrary PHP code on the web server. [-] Proof of Concept: https://karmainsecurity.com/pocs/CVE-2023-46818.php [-] Solution: Upgrade to version 3.2.11p1 or later. [-] Disclosure Timeline: [25/10/2023] - Vendor notified [26/10/2023] - Version 3.2.11p1 released [27/10/2023] - CVE identifier assigned [07/12/2023] - Publication of this advisory [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2023-46818 to this vulnerability. [-] Credits: Vulnerability discovered by Egidio Romano. [-] Original Advisory: https://karmainsecurity.com/KIS-2023-13 [-] Other References: https://www.ispconfig.org/blog/ispconfig-3-2-11p1-released/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Powered by blists - more mailing lists