PT-2025-52320 · Unknown · Easyphp Webserver

Rafael Pedrero · Published 2025-12-18 · Updated 2025-12-26 · CVE-2023-53941

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EasyPHP Webserver version 14.1

Description An unauthenticated attacker can execute arbitrary system commands. This is possible by injecting malicious payloads through the app service control parameter. Attackers can send POST requests to the ''/index.php?zone=settings'' endpoint with crafted app service control values to execute commands with administrative privileges.

Recommendations Upgrade EasyPHP Webserver version 14.1 to address this issue.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-53941

Affected Products

Easyphp Webserver

References · 9

• 🔥 https://vulncheck.com/advisories/easyphp-webserver-remote-code-execution · Exploit
• 🔥 https://exploit-db.com/exploits/51430 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53941 · Security Note
• https://osv.dev/vulnerability/CVE-2023-53941 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2001754217380286604 · Twitter Post
• https://easyphp.org · Note
• https://twitter.com/0dayPublishing/status/2001746941022015550 · Twitter Post
• https://t.me/cveNotify/146902 · Telegram Post
• https://twitter.com/CVEnew/status/2002117785489416283 · Twitter Post