Vulnerability · Published Feb 21, 2023 · Assigned by VulDB

CVE-2023-0935DolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injection

Medium 6.3

In plain English

A medium-severity OS command injection in DolphinPHP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.8% (higher than 92% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)4.8%top 8.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file common.php of the component Incomplete Fix CVE-2021-46097. The manipulation of the argument id leads to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221551.

Affected products (as reported)

Vendor	Product	Versions
n/a	DolphinPHP	1.5.01.5.1

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.221551 vdb-entry, technical-description
https://vuldb.com/?ctiid.221551 signature, permissions-required
https://github.com/ssteveez/dolphin/blob/main/README.md exploit