CVE-2023-53895
CriticalSummary
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.
Risk Assessment
An attacker can gain unauthorized administrative access, potentially leading to application takeover and sensitive data leakage.
Recommendation
Upgrade PimpMyLog to the latest version and implement proper authentication and input sanitization mechanisms.
Original NVD description (English source)
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.