PT-2023-22010 · Nophp · Nophp

Paijp · Publicado 2023-04-03 · Atualizado 2023-04-12 · CVE-2023-28854

Positive Technologies (AI Summary)

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nophp versions prior to 0.0.1

Description The issue affects the nophp PHP web framework, where versions prior to 0.0.1 are vulnerable to shell command injection on the httpd user. A patch was made available to address this issue.

Recommendations For versions prior to 0.0.1, update index.php to 2023-03-30 or later. As a temporary workaround for versions prior to 0.0.1, consider adding a function such as env patchsample230330.php to env.php.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2023-28854

GHSA-9858-Q3C2-9WWM

Produtos afetados

Nophp

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28854.json · Exploit
• https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa · Correção
• https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm · Aviso do Fabricante
• https://github.com/paijp/nophp/releases/tag/v0.0.1 · Nota
• https://t.me/cibsecurity/61346 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28854 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28854 · Nota de Segurança