// For flags

CVE-2023-3607

kodbox WebConsole Plug-In webconsole.php.txt Execute os command injection

Severity Score

8.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was found in kodbox 1.26. It has been declared as critical. This vulnerability affects the function Execute of the file webconsole.php.txt of the component WebConsole Plug-In. The manipulation leads to os command injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-233476. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Se ha encontrado una vulnerabilidad en kodbox v1.26. Ha sido declarada como crítica. Esta vulnerabilidad afecta a la función "Execute" del fichero "webconsole.php.txt" del componente "WebConsole Plug-In". La manipulación conduce a la inyección de comandos de tipo "os". El exploit ha sido revelado al público y puede ser utilizado. El identificador de esta vulnerabilidad es VDB-233476. NOTA: Se contactó con el proveedor a tiempo sobre esta divulgación pero no respondió de ninguna manera.

In kodbox 1.26 wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Das betrifft die Funktion Execute der Datei webconsole.php.txt der Komponente WebConsole Plug-In. Dank Manipulation mit unbekannten Daten kann eine os command injection-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung.

*Credits: XCES
CVSS Scores
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Adjacent
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-07-10 CVE Reserved
  • 2023-07-10 CVE Published
  • 2024-05-29 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (2)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Kodcloud
Search vendor "Kodcloud"
Kodbox
Search vendor "Kodcloud" for product "Kodbox"
1.26
Search vendor "Kodcloud" for product "Kodbox" and version "1.26"
-
Affected