PT-2026-2425 · Extplorer · Extplorer

Erpaciocco · Publicado 2026-01-13 · Atualizado 2026-01-15 · CVE-2023-54335

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions eXtplorer version 2.1.14

Description eXtplorer version 2.1.14 contains an authentication bypass that allows attackers to log in without a password by manipulating the login request. Successful exploitation enables attackers to upload malicious PHP files and execute remote commands on the vulnerable file management system. The vulnerability is exploitable via manipulation of the login process. The affected API endpoint is the login function. The vulnerable parameter is the login request.

Recommendations Apply a fix for eXtplorer version 2.1.14 to address the authentication bypass.

Exploit

Correção

RCE

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2023-54335

Produtos afetados

Extplorer

Referências · 11

• 🔥 https://exploit-db.com/exploits/51067 · Exploit
• https://twitter.com/pulsepatchio/status/2011808215260877084 · Publicação no Twitter
• https://extplorer.net · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-54335 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2011383041193636078 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2023-54335 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-54335 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-54335 · Nota de Segurança
• https://vulncheck.com/advisories/extplorer-authentication-bypass-remote-code-execution-rce · Nota
• https://osv.dev/vulnerability/CVE-2023-54335 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2011259955651719583 · Publicação no Twitter