CVE-2023-28854 - Vulnerability Details - OpenCVE

nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Nophp Project	Nophp

Configuration 1 [-]

cpe:2.3:a:nophp_project:nophp:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa
https://github.com/paijp/nophp/releases/tag/v0.0.1
https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm

History

Tue, 11 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-04-03T17:55:56.789Z

Updated: 2025-02-11T14:35:47.164Z

Reserved: 2023-03-24T16:25:34.468Z

Link: CVE-2023-28854

Vulnrichment

Updated: 2024-08-02T13:51:38.395Z

NVD

Status : Modified

Published: 2023-04-03T18:15:07.987

Modified: 2024-11-21T07:56:09.837

Link: CVE-2023-28854

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-28854", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-03-24T16:25:34.468Z", "datePublished": "2023-04-03T17:55:56.789Z", "dateUpdated": "2025-02-11T14:35:47.164Z"}, "containers": {"cna": {"title": "nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm"}, {"name": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa", "tags": ["x_refsource_MISC"], "url": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa"}, {"name": "https://github.com/paijp/nophp/releases/tag/v0.0.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/paijp/nophp/releases/tag/v0.0.1"}], "affected": [{"vendor": "paijp", "product": "nophp", "versions": [{"version": "< 0.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-03T17:55:56.789Z"}, "descriptions": [{"lang": "en", "value": "nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php."}], "source": {"advisory": "GHSA-9858-q3c2-9wwm", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:51:38.395Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm"}, {"name": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa"}, {"name": "https://github.com/paijp/nophp/releases/tag/v0.0.1", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/paijp/nophp/releases/tag/v0.0.1"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-11T14:35:39.425232Z", "id": "CVE-2023-28854", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T14:35:47.164Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm", "name": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa", "name": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa", "tags": ["x_refsource_MISC", "x_transferred"]}, {"url": "https://github.com/paijp/nophp/releases/tag/v0.0.1", "name": "https://github.com/paijp/nophp/releases/tag/v0.0.1", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T13:51:38.395Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-28854", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-11T14:35:39.425232Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T14:30:56.229Z"}}], "cna": {"title": "nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail", "source": {"advisory": "GHSA-9858-q3c2-9wwm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "paijp", "product": "nophp", "versions": [{"status": "affected", "version": "< 0.0.1"}]}], "references": [{"url": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm", "name": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa", "name": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/paijp/nophp/releases/tag/v0.0.1", "name": "https://github.com/paijp/nophp/releases/tag/v0.0.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-04-03T17:55:56.789Z"}}}, "cveMetadata": {"cveId": "CVE-2023-28854", "state": "PUBLISHED", "dateUpdated": "2025-02-11T14:35:47.164Z", "dateReserved": "2023-03-24T16:25:34.468Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-04-03T17:55:56.789Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nophp_project:nophp:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEB4ED43-154C-4441-ADEE-0F655940A473", "versionEndExcluding": "0.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php."}], "id": "CVE-2023-28854", "lastModified": "2024-11-21T07:56:09.837", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-04-03T18:15:07.987", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/paijp/nophp/releases/tag/v0.0.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/paijp/nophp/commit/e5409aa2d441789cbb35f6b119bef97ecc3986aa"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes"], "url": "https://github.com/paijp/nophp/releases/tag/v0.0.1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/paijp/nophp/security/advisories/GHSA-9858-q3c2-9wwm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Secondary"}]}