PT-2023-30234 · Ispconfig · Ispconfig

Egidio Romano · Published 2023-10-27 · Updated 2025-08-16 · CVE-2023-46818

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ISPConfig versions prior to 3.2.11p1

Description An issue was discovered that allows PHP code injection in the language file editor by an admin if admin allow langedit is enabled. This issue can be exploited to achieve PHP code injection.

Recommendations For versions prior to 3.2.11p1, update to version 3.2.11p1 or later to resolve the issue. As a temporary workaround, consider disabling the language file editor or restricting the admin allow langedit setting until a patch is applied.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-46818

Affected Products

Ispconfig

References · 21

• https://osv.dev/vulnerability/CVE-2023-46818 · Vendor Advisory
• https://ispconfig.org/blog/ispconfig-3-2-11p1-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46818 · Security Note
• https://twitter.com/cyberoux/status/1732815300444250258 · Twitter Post
• https://twitter.com/TheHackForce/status/1735182472768303109 · Twitter Post
• https://twitter.com/0xd3vnull/status/1918050459157250138 · Twitter Post
• https://t.me/cvenotify/63375 · Telegram Post
• https://twitter.com/raihan_hafis212/status/1942421138283585956 · Twitter Post
• https://t.me/cvenotify/62965 · Telegram Post
• https://twitter.com/_kujen5/status/1956755320069562395 · Twitter Post
• http://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html · Note
• https://t.me/cybersecuritytechnologies/9584 · Telegram Post
• https://t.me/freedomf0x/20758 · Telegram Post
• http://seclists.org/fulldisclosure/2023/Dec/2 · Note
• https://twitter.com/PHPDiscussions/status/1734044932418023740 · Twitter Post