PT-2025-51301 · Unknown · Webedition Cms

Mirabbas Ağalarov · CVE-2023-53883 · Publicado 2025-12-15 · Atualizado 2025-12-21

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Webedition CMS version 2.9.8.8

Description Webedition CMS version 2.9.8.8 has a flaw that permits authenticated attackers to execute system commands remotely. This is achieved by creating a new PHP page and inserting malicious system commands within the description field. This allows for arbitrary command execution on the server. The vulnerable functionality involves the creation of PHP pages. The affected parameter is the description field during PHP page creation.

Recommendations Apply a fix that prevents the execution of system commands within the description field during PHP page creation.

Exploit

Correção

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-53883

Produtos afetados

Webedition Cms

Referências · 7

• 🔥 https://exploit-db.com/exploits/51661 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53883 · Aviso do Fabricante
• https://webedition.org · Nota
• https://twitter.com/VulmonFeeds/status/2000730427976192112 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-53883 · Nota de Segurança
• https://vulncheck.com/advisories/webedition-cms-v-remote-code-execution-via-php-page-creation · Nota
• https://twitter.com/CVEnew/status/2002857368338743311 · Publicação no Twitter