Vulnerability · Published Mar 31, 2023 · Assigned by VulDB

CVE-2023-1773Rockoa Configuration File webmainConfig.php code injection

Medium 6.3

In plain English

A medium-severity code injection in Rockoa. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)1.6%top 23.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

A vulnerability was found in Rockoa 2.3.2. It has been declared as critical. This vulnerability affects unknown code of the file webmainConfig.php of the component Configuration File Handler. The manipulation leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-224674 is the identifier assigned to this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
n/a	Rockoa	2.3.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.224674 vdb-entry, technical-description
https://vuldb.com/?ctiid.224674 signature, permissions-required
https://gitee.com/galaxies2580/cve/blob/master/xinhuv2.3.2.md exploit