CVE-2023-54335

eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)

CVSS 9.3 CRITICALEPSS 5.0%CWE-306

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Extplorer · eXtplorer

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/51067unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://extplorer.net/https://www.exploit-db.com/exploits/51067 https://www.vulncheck.com/advisories/extplorer-authentication-bypass-remote-code-execution-rce