Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 16/10/2023 Updated: 18/10/2023

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 0

An OS command injection vulnerability exists in web2py 2.24.1 and previous versions. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

Vulnerable Product	Search on Vulmon	Subscribe to Product
web2py web2py

CVE-2023-45158 Steps Run the webserver cd web2py python3 web2pypy Inject your command using the URL <IP-ADDRESS>:8000/hack?msg=%27%3B<YOUR-COMMAND>%3B%27 Replace <IP-ADDRESS> and <YOUR-COMMAND> with your values Examples Create a file on the server <IP-ADD

CWE-78 http://web2py.com/init/default/download https://jvn.jp/en/jp/JVN80476432/https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3 http://web2py.com/https://nvd.nist.gov https://github.com/Evan-Zhangyf/CVE-2023-45158

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2023-45158

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect