PT-2025-31537 · Undefined · Undefined

Published 2025-07-31 · Updated 2025-07-31 · CVE-2013-10039

NVD

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip checkhost.cgi. Crafted input to the 'ip' parameter allows attackers to execute arbitrary shell commands on the server via embedded base64-encoded payloads. Authentication may be required depending on deployment configuration.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2013-10039

Affected Products

Undefined

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2013-10039 · Security Note
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/gestioip_exec.rb · Note
• https://sourceforge.net/p/gestioip/gestioip/ci/ac67be9fce5ee4c0438d27dfa5c1dcbca08c457c · Note
• https://sourceforge.net/projects/gestioip · Note
• https://vulncheck.com/advisories/gestioip-rce · Note