CVE-2013-10037

WebTester 5.x install2.php Unauthenticated Command Execution

CVSS 9.3 CRITICALEPSS 9.9%CWE-78

Vexday Risk Score

63Prioridad alta

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 9.3EPSS 9.9%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

17 oct 2013Exploit Metasploit disponible

31 jul 2025Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Productos afectados

Eppler Software · WebTester

PoCs públicas encontradas — 2

cve_referenceraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/webtester_exec.rbno verificado cve_referencewww.exploit-db.com/exploits/29132no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

https://advisories.checkpoint.com/defense/advisories/public/2014/cpai-2014-1620.html https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/webtester_exec.rb https://sourceforge.net/p/webtesteronline/bugs/3/https://www.exploit-db.com/exploits/29132 https://www.vulncheck.com/advisories/webtester-unauth-command-execution