ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability
• Software Link:
• Affected Versions:
Version 3.2.11 and prior versions.
• Vulnerability Description:
User input passed through the “records” POST parameter to /admin/language_edit.php is not properly sanitized before being used to dynamically generate PHP code that will be executed by the application. This can be exploited by malicious administrator users to inject and execute arbitrary PHP code on the web server.
• Proof of Concept:
https://karmainsecurity.com/pocs/CVE-2023-46818.php
• Solution:
Upgrade to version 3.2.11p1 or later.
• Disclosure Timeline:
[25/10/2023] – Vendor notified
[26/10/2023] – Version 3.2.11p1 released
[27/10/2023] – CVE identifier assigned
[07/12/2023] – Publication of this advisory
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2023-46818 to this vulnerability.
• Credits:
Vulnerability discovered by Egidio Romano.