PT-2023-22010 · Nophp · Nophp

Paijp · Published 2023-04-03 · Updated 2023-04-12 · CVE-2023-28854

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nophp versions prior to 0.0.1

Description The issue affects the nophp PHP web framework, where versions prior to 0.0.1 are vulnerable to shell command injection on the httpd user. A patch was made available to address this issue.

Recommendations For versions prior to 0.0.1, update index.php to 2023-03-30 or later. As a temporary workaround for versions prior to 0.0.1, consider adding a function such as env patchsample230330.php to env.php.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-28854

GHSA-9858-Q3C2-9WWM

Affected Products

Nophp

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28854.json · Exploit
• https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa · Patch
• https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28854 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28854 · Security Note
• https://github.com/paijp/nophp/releases/tag/v0.0.1 · Note
• https://t.me/cibsecurity/61346 · Telegram Post