fkie_cve-2013-10035
Vulnerability from fkie_nvd
Published
2025-07-31 15:15
Modified
2025-07-31 18:42
Severity ?
Summary
A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default \u0027neoclassic\u0027 skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en las versiones 2.x de c\u00f3digo abierto de ProcessMaker al usar la interfaz predeterminada \"neoclassic\". Un usuario autenticado puede ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de m\u00faltiples endpoints, como appFolderAjax.php, casesStartPage_Ajax.php y cases_SchedulerGetPlugins.php, al proporcionar solicitudes POST manipuladas a par\u00e1metros como action y params. Estos endpoints no validan la entrada del usuario e invocan directamente funciones PHP como system() con par\u00e1metros proporcionados por el usuario, lo que permite la ejecuci\u00f3n remota de c\u00f3digo. La vulnerabilidad afecta tanto a instalaciones de Linux como de Windows y est\u00e1 presente en las configuraciones predeterminadas de las versiones 2.0.23 a 2.5.1. La interfaz vulnerable no se puede eliminar a trav\u00e9s de la interfaz web, y para su explotaci\u00f3n solo se requieren credenciales de usuario v\u00e1lidas."
}
],
"id": "CVE-2013-10035",
"lastModified": "2025-07-31T18:42:37.870",
"metrics": {
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "disclosure@vulncheck.com",
"type": "Secondary"
}
]
},
"published": "2025-07-31T15:15:33.100",
"references": [
{
"source": "disclosure@vulncheck.com",
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_exec.rb"
},
{
"source": "disclosure@vulncheck.com",
"url": "https://web.archive.org/web/20150419043936/https://bugs.processmaker.com/view.php?id=13436"
},
{
"source": "disclosure@vulncheck.com",
"url": "https://www.exploit-db.com/exploits/29325"
},
{
"source": "disclosure@vulncheck.com",
"url": "https://www.fortiguard.com/encyclopedia/ips/37390"
},
{
"source": "disclosure@vulncheck.com",
"url": "https://www.vulncheck.com/advisories/processmaker-open-source-neoclassic-skin-php-code-execution"
}
],
"sourceIdentifier": "disclosure@vulncheck.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "disclosure@vulncheck.com",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…