9.8

CVE-2023-47253

Exploit
Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Qualitor ≫ Qualitor Version <= 8.20
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 14.42% 0.962
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

https://www.linkedin.com/in/xvinicius/
Permissions Required
https://openxp.xpsec.co/blog/cve-2023-47253
Third Party Advisory
Exploit
https://www.linkedin.com/in/hairrison-wenning-4631a4124/
Not Applicable
https://www.qualitor.com.br/qualitor-8-20
Product
Release Notes
https://www.qualitor.com.br/official-security-advisory-cve-2023-47253
Vendor Advisory