CVE-2023-54339: Webgrind 1.1 - Remote Command Execution (RCE) via dataFile Parameter
Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS commands via the dataFile parameter in index.php. Attackers can execute arbitrary system commands by manipulating the dataFile parameter, such as using payload '0%27%26calc.exe%26%27' to execute commands on the target system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54339?
CVE-2023-54339 is rated as a critical vulnerability due to its potential for remote command execution by unauthenticated attackers.
How do I fix CVE-2023-54339?
To fix CVE-2023-54339, you should update Webgrind to the latest version that includes a patch for this vulnerability.
Who is affected by CVE-2023-54339?
CVE-2023-54339 affects all installations of Webgrind version 1.1 that do not have applied security patches.
What type of attacks can be performed using CVE-2023-54339?
Attackers can exploit CVE-2023-54339 to execute arbitrary OS commands on the server, leading to full system compromise.
Is authentication required to exploit CVE-2023-54339?
No, CVE-2023-54339 can be exploited by unauthenticated attackers, making it particularly dangerous.