dst-admin kickPlayer command injection
CVE-2023-0647

7.5HIGH

Key Information:

Vendor

Dst-admin Project

Status
dst-admin
Vendor
CVE Published:
2 February 2023

What is CVE-2023-0647?

A command injection vulnerability exists in the dst-admin product version 1.5.0, where manipulation of the userId argument in the file /home/kickPlayer allows an attacker to execute arbitrary commands remotely. This exploit, once publicly disclosed, poses a significant security risk and underscores the importance of updating software to mitigate such issues.

Affected Version(s)

dst-admin 1.5.0

References

https://vuldb.com/?id.220034
vdb-entrytechnical-description
https://vuldb.com/?ctiid.220034
signaturepermissions-required
https://github.com/Ha0Liu/cveAdd/blob/developer/dst-admin...
exploit

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

yanfei.chen (VulDB User)
.