CVE-2023-53872
CriticalSummary
Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.
Risk Assessment
The risk is high because an attacker can execute arbitrary commands on the server, potentially leading to full system compromise.
Recommendation
Immediately implement fixes, such as input validation and avoiding execution of system commands based on user input.
Original NVD description (English source)
Wp2Fac 1.0 contains an OS command injection vulnerability in the send.php endpoint that allows remote attackers to execute arbitrary system commands. Attackers can inject shell commands through the 'numara' parameter by appending shell commands with '&' operators to execute malicious code.