by Kastro
Paper/Archive/CVE-2023-53895

CVE-2023-53895

Pimpmylog PimpMyLog — PimpMyLog 1.7.14 Improper Access Control via Account Creation Endpoint

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 52.2.522 × 2010.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially access sensitive server-side log information and environmental variables.

Affected

ProductAffectedFixed inSource
PimpMyLog1.7.14–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/51593refpimpmylog.comrefgithub.com/potsky/PimpMyLogwriteupvulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint