CWE-94
Allowed-with-ReviewImproper Control of Generation of Code ('Code Injection')
Abstraction: Base · Status: Draft
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
9240 vulnerabilities reference this CWE, most recent first.
GHSA-344G-JVX4-773R
Vulnerability from github – Published: 2024-08-13 03:31 – Updated: 2026-04-08 18:33The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added.
{
"affected": [],
"aliases": [
"CVE-2024-7094"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-13T03:15:04Z",
"severity": "CRITICAL"
},
"details": "The JS Help Desk \u2013 The Ultimate Help Desk \u0026 Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the \u0027storeTheme\u0027 function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially patched in 2.8.6 when the code injection issue was resolved, and fully patched in 2.8.7 when the missing authorization and cross-site request forgery protection was added.",
"id": "GHSA-344g-jvx4-773r",
"modified": "2026-04-08T18:33:34Z",
"published": "2024-08-13T03:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7094"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/css/style.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/includes/formhandler.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/controller.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/model.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/js-support-ticket/tags/2.8.5/modules/themes/tpls/admin_themes.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/31513f9e-6185-425b-9e7e-36f21f72d0a2?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-346J-7CVJ-X28V
Vulnerability from github – Published: 2022-05-01 18:25 – Updated: 2022-05-01 18:25Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload and execute arbitrary PHP files in uploads/ via an Uploads action.
{
"affected": [],
"aliases": [
"CVE-2007-4640"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-08-31T23:17:00Z",
"severity": "MODERATE"
},
"details": "Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload and execute arbitrary PHP files in uploads/ via an Uploads action.",
"id": "GHSA-346j-7cvj-x28v",
"modified": "2022-05-01T18:25:39Z",
"published": "2022-05-01T18:25:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4640"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36357"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/4341"
},
{
"type": "WEB",
"url": "http://osvdb.org/38670"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/26598"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/25491"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-346Q-MH4Q-V382
Vulnerability from github – Published: 2022-05-01 18:33 – Updated: 2022-05-01 18:33Static code injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter.
{
"affected": [],
"aliases": [
"CVE-2007-5492"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2007-10-17T19:17:00Z",
"severity": "MODERATE"
},
"details": "Static code injection vulnerability in the translation module (translator.php) in SiteBar 3.3.8 allows remote authenticated users to execute arbitrary PHP code via the value parameter.",
"id": "GHSA-346q-mh4q-v382",
"modified": "2022-05-01T18:33:59Z",
"published": "2022-05-01T18:33:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5492"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/attachment.cgi?id=133465\u0026action=view"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=195810"
},
{
"type": "WEB",
"url": "http://osvdb.org/43760"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/27503"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/28008"
},
{
"type": "WEB",
"url": "http://teamforge.net/viewcvs/viewcvs.cgi/tags/release-3.3.9/doc/history.txt?view=markup"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2007/dsa-1423"
},
{
"type": "WEB",
"url": "http://www.gentoo.org/security/en/glsa/glsa-200711-05.xml"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/482499/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/26126"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2007/3768"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-347C-85VR-J5X8
Vulnerability from github – Published: 2021-12-27 00:00 – Updated: 2022-07-13 00:01Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RBR20 before 2.5.1.16, RBS20 before 2.5.1.16, RBK50 before 2.5.1.16, RBR50 before 2.5.1.16, RBS50 before 2.5.1.16, and RBS50Y before 2.6.1.40.
{
"affected": [],
"aliases": [
"CVE-2021-45661"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-26T01:15:00Z",
"severity": "HIGH"
},
"details": "Certain NETGEAR devices are affected by server-side injection. This affects RBK40 before 2.5.1.16, RBR40 before 2.5.1.16, RBS40 before 2.5.1.16, RBK20 before 2.5.1.16, RBR20 before 2.5.1.16, RBS20 before 2.5.1.16, RBK50 before 2.5.1.16, RBR50 before 2.5.1.16, RBS50 before 2.5.1.16, and RBS50Y before 2.6.1.40.",
"id": "GHSA-347c-85vr-j5x8",
"modified": "2022-07-13T00:01:51Z",
"published": "2021-12-27T00:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45661"
},
{
"type": "WEB",
"url": "https://kb.netgear.com/000064065/Security-Advisory-for-Server-Side-Injection-on-Some-WiFi-Systems-PSV-2019-0134"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-347M-P67J-PVQR
Vulnerability from github – Published: 2026-07-01 18:31 – Updated: 2026-07-01 18:31JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the config endpoint to invoke it via popen(), achieving persistent remote code execution that survives device reboots.
{
"affected": [],
"aliases": [
"CVE-2026-58454"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-01T17:16:40Z",
"severity": "HIGH"
},
"details": "JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing to the writable persistent JFFS2 storage path and triggering execution through the authenticated HTTP endpoint. Attackers can stage a malicious script in the writable persistent storage and request the config endpoint to invoke it via popen(), achieving persistent remote code execution that survives device reboots.",
"id": "GHSA-347m-p67j-pvqr",
"modified": "2026-07-01T18:31:56Z",
"published": "2026-07-01T18:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58454"
},
{
"type": "WEB",
"url": "https://github.com/rwprimitives/jaiotlink-c492a-wifi-camera/blob/main/writeups/03-anyka-config-execution-trigger.md"
},
{
"type": "WEB",
"url": "https://www.amazon.com/stores/JAIOTlink/page/3B00DC41-70C3-4BAA-925C-3D222C2633D5?lp_asin=B0GX1BNZ78\u0026ref_=ast_bln\u0026store_ref=bl_ast_dp_brandlogo_sto"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jaiotlink-c492a-w6-rce-via-anyka-config-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-3496-9G83-7V6X
Vulnerability from github – Published: 2026-08-17 17:20 – Updated: 2026-08-17 17:20Summary
The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language string, and place attacker-controlled code into the generated snippet. If a downstream consumer executes or imports that generated source, the injected code runs in the consumer's environment.
Details
The Python output filter places SQL in a single-quoted string and replaces each single quote with an escaped quote. The PHP output filter performs the equivalent operation for a double-quoted string. Neither transformation escapes pre-existing backslashes before escaping quotes. A backslash supplied immediately before a quote causes the generated backslash to be escaped instead of the quote, allowing the quote to close the string.
The affected modes are exposed through sqlparse.format(..., output_format='python'), sqlparse.format(..., output_format='php'), and the corresponding sqlformat -l options. Formatting produces the injected source but does not itself execute it; code execution occurs when a downstream workflow treats the generated snippet as Python or PHP code.
Relevant code locations:
sqlparse/formatter.py:193— selection of the output-language filterssqlparse/filters/output.py:45— opening of the generated Python stringsqlparse/filters/output.py:65— incomplete Python quote escapingsqlparse/filters/output.py:91— opening of the generated PHP stringsqlparse/filters/output.py:114— incomplete PHP quote escaping
PoC
A complete validated reproduction is attached as output_format_snippet_injection-poc.zip. The archive contains reproduction/ at its root, uses Git and Docker, and validates the Python output path by generating and executing a snippet containing a controlled marker-file write.
Extract the archive beside this report, then run:
./reproduction/run.sh
Observed result:
The generated Python snippet placed the attacker-controlled pathlib.Path(...).write_text(...) expression outside the intended SQL string. Executing the snippet wrote the expected proof marker, emitted EVOHUNT_OUTPUT_FORMAT_INJECTION_VERIFIED, and completed successfully.
Verification method:
The verification helper calls sqlparse.format(..., output_format='python'), executes the generated snippet, and fails unless the injected Python expression writes the exact proof marker file.
Limitations:
No reproduction blocker was recorded. The attached harness directly verifies the Python output path; exploitation also requires a downstream consumer to execute or import the generated source.
Impact
This is source-code injection in the opt-in Python and PHP snippet-generation modes. An attacker who controls SQL converted by one of these modes can inject language code into the generated artifact. If that artifact is subsequently executed, the attacker can run code with the permissions and access of the downstream Python or PHP process.
The demonstrated end-to-end result is code execution through a generated Python snippet. Formatting the SQL alone does not execute the payload, and ordinary parsing, splitting, or formatting without these output modes is not shown to be affected.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.5.5"
},
"package": {
"ecosystem": "PyPI",
"name": "sqlparse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59894"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-17T17:20:11Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language string, and place attacker-controlled code into the generated snippet. If a downstream consumer executes or imports that generated source, the injected code runs in the consumer\u0027s environment.\n\n### Details\n\nThe Python output filter places SQL in a single-quoted string and replaces each single quote with an escaped quote. The PHP output filter performs the equivalent operation for a double-quoted string. Neither transformation escapes pre-existing backslashes before escaping quotes. A backslash supplied immediately before a quote causes the generated backslash to be escaped instead of the quote, allowing the quote to close the string.\n\nThe affected modes are exposed through `sqlparse.format(..., output_format=\u0027python\u0027)`, `sqlparse.format(..., output_format=\u0027php\u0027)`, and the corresponding `sqlformat -l` options. Formatting produces the injected source but does not itself execute it; code execution occurs when a downstream workflow treats the generated snippet as Python or PHP code.\n\nRelevant code locations:\n\n- `sqlparse/formatter.py:193` \u2014 selection of the output-language filters\n- `sqlparse/filters/output.py:45` \u2014 opening of the generated Python string\n- `sqlparse/filters/output.py:65` \u2014 incomplete Python quote escaping\n- `sqlparse/filters/output.py:91` \u2014 opening of the generated PHP string\n- `sqlparse/filters/output.py:114` \u2014 incomplete PHP quote escaping\n\n### PoC\n\nA complete validated reproduction is attached as [output_format_snippet_injection-poc.zip](https://github.com/user-attachments/files/29410134/output_format_snippet_injection-poc.zip). The archive contains `reproduction/` at its root, uses Git and Docker, and validates the Python output path by generating and executing a snippet containing a controlled marker-file write.\n\nExtract the archive beside this report, then run:\n\n```console\n./reproduction/run.sh\n```\n\nObserved result:\n\nThe generated Python snippet placed the attacker-controlled `pathlib.Path(...).write_text(...)` expression outside the intended SQL string. Executing the snippet wrote the expected proof marker, emitted `EVOHUNT_OUTPUT_FORMAT_INJECTION_VERIFIED`, and completed successfully.\n\nVerification method:\n\nThe verification helper calls `sqlparse.format(..., output_format=\u0027python\u0027)`, executes the generated snippet, and fails unless the injected Python expression writes the exact proof marker file.\n\nLimitations:\n\nNo reproduction blocker was recorded. The attached harness directly verifies the Python output path; exploitation also requires a downstream consumer to execute or import the generated source.\n\n### Impact\n\nThis is source-code injection in the opt-in Python and PHP snippet-generation modes. An attacker who controls SQL converted by one of these modes can inject language code into the generated artifact. If that artifact is subsequently executed, the attacker can run code with the permissions and access of the downstream Python or PHP process.\n\nThe demonstrated end-to-end result is code execution through a generated Python snippet. Formatting the SQL alone does not execute the payload, and ordinary parsing, splitting, or formatting without these output modes is not shown to be affected.",
"id": "GHSA-3496-9g83-7v6x",
"modified": "2026-08-17T17:20:11Z",
"published": "2026-08-17T17:20:11Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-3496-9g83-7v6x"
},
{
"type": "WEB",
"url": "https://github.com/andialbrecht/sqlparse/commit/53ff44b53e27cff78259acc1af015506fea60f63"
},
{
"type": "PACKAGE",
"url": "https://github.com/andialbrecht/sqlparse"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:L",
"type": "CVSS_V4"
}
],
"summary": "sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes"
}
GHSA-34FF-V8WX-W9F5
Vulnerability from github – Published: 2022-05-17 03:23 – Updated: 2022-05-17 03:23RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
{
"affected": [],
"aliases": [
"CVE-2011-3378"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-12-24T19:55:00Z",
"severity": "HIGH"
},
"details": "RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.",
"id": "GHSA-34ff-v8wx-w9f5",
"modified": "2022-05-17T03:23:42Z",
"published": "2022-05-17T03:23:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3378"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2011:1349"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2011-3378"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=741606"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=741612"
},
{
"type": "WEB",
"url": "http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10691"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00002.html"
},
{
"type": "WEB",
"url": "http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=11a7e5d95a8ca8c7d4eaff179094afd8bb74fc3f"
},
{
"type": "WEB",
"url": "http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=a48f0e20cbe2ababc88b2fc52fb7a281d6fc1656"
},
{
"type": "WEB",
"url": "http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=11a7e5d95a8ca8c7d4eaff179094afd8bb74fc3f"
},
{
"type": "WEB",
"url": "http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=a48f0e20cbe2ababc88b2fc52fb7a281d6fc1656"
},
{
"type": "WEB",
"url": "http://rpm.org/wiki/Releases/4.9.1.2#Security"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:143"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2011/09/27/3"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2011-1349.html"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1695-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-34FJ-R5GQ-7395
Vulnerability from github – Published: 2024-04-10 17:11 – Updated: 2024-04-10 22:00Impact
Any user with edit right on any page can execute any code on the server by adding an object of type XWiki.SearchSuggestSourceClass to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.
To reproduce on an instance, as a user without script nor programming rights, add an object of type XWiki.SearchSuggestSourceClass to your profile page. On this object, set every possible property to }}}{{async}}{{groovy}}println("Hello from Groovy!"){{/groovy}}{{/async}} (i.e., name, engine, service, query, limit and icon). Save and display the page, then append ?sheet=XWiki.SearchSuggestSourceSheet to the URL. If any property displays as Hello from Groovy!}}}, then the instance is vulnerable.
Patches
This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1.
Workarounds
This patch can be manually applied to the document XWiki.SearchSuggestSourceSheet.
References
- https://jira.xwiki.org/browse/XWIKI-21474
- https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-search-ui"
},
"ranges": [
{
"events": [
{
"introduced": "5.2-milestone-2"
},
{
"fixed": "14.10.20"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-search-ui"
},
"ranges": [
{
"events": [
{
"introduced": "15.0-rc-1"
},
{
"fixed": "15.5.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-search-ui"
},
"ranges": [
{
"events": [
{
"introduced": "15.6-rc-1"
},
{
"fixed": "15.10-rc-1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-31465"
],
"database_specific": {
"cwe_ids": [
"CWE-94",
"CWE-95"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-10T17:11:32Z",
"nvd_published_at": "2024-04-10T20:15:07Z",
"severity": "CRITICAL"
},
"details": "### Impact\nAny user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other page. This compromises the confidentiality, integrity and availability of the whole XWiki installation.\n\nTo reproduce on an instance, as a user without script nor programming rights, add an object of type `XWiki.SearchSuggestSourceClass` to your profile page. On this object, set every possible property to `}}}{{async}}{{groovy}}println(\"Hello from Groovy!\"){{/groovy}}{{/async}}` (i.e., name, engine, service, query, limit and icon). Save and display the page, then append `?sheet=XWiki.SearchSuggestSourceSheet` to the URL. If any property displays as `Hello from Groovy!}}}`, then the instance is vulnerable.\n\n### Patches\nThis vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10 RC1.\n\n### Workarounds\n[This patch](https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809#diff-67b473d2b6397d65b7726c6a13555850b11b10128321adf9e627e656e1d130a5) can be manually applied to the document `XWiki.SearchSuggestSourceSheet`.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-21474\n* https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809\n",
"id": "GHSA-34fj-r5gq-7395",
"modified": "2024-04-10T22:00:40Z",
"published": "2024-04-10T17:11:32Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-34fj-r5gq-7395"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31465"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/0317a3aa78065e66c86fc725976b06bf7f9b446e"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/2740974c32dbb7cc565546d0f04e2374b32b36f7"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/6a7f19f6424036fce3d703413137adde950ae809#diff-67b473d2b6397d65b7726c6a13555850b11b10128321adf9e627e656e1d130a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-platform"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-21474"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet"
}
GHSA-34JQ-F4VW-GCM5
Vulnerability from github – Published: 2022-05-01 07:28 – Updated: 2022-05-01 07:28PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to execute arbitrary PHP code via the rootpath parameter.
{
"affected": [],
"aliases": [
"CVE-2006-5480"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-10-24T20:07:00Z",
"severity": "MODERATE"
},
"details": "PHP remote file inclusion vulnerability in lib/rs.php in 2le.net Castor PHP Web Builder 1.1.1 allows remote attackers to execute arbitrary PHP code via the rootpath parameter.",
"id": "GHSA-34jq-f4vw-gcm5",
"modified": "2022-05-01T07:28:51Z",
"published": "2022-05-01T07:28:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5480"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29704"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/2606"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/22527"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/20658"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/4143"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-34JX-Q9XG-RR5X
Vulnerability from github – Published: 2023-12-29 09:30 – Updated: 2026-04-28 21:33Improper Control of Generation of Code ('Code Injection') vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: from n/a through 2.0.3.
{
"affected": [],
"aliases": [
"CVE-2023-45751"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-29T09:15:09Z",
"severity": "CRITICAL"
},
"details": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in POSIMYTH Nexter Extension.This issue affects Nexter Extension: from n/a through 2.0.3.",
"id": "GHSA-34jx-q9xg-rr5x",
"modified": "2026-04-28T21:33:38Z",
"published": "2023-12-29T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45751"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/nexter-extension/wordpress-nexter-extension-plugin-2-0-3-remote-code-execution-rce-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Strategy: Refactoring
Refactor your program so that you do not have to dynamically generate code.
Mitigation
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation MIT-32
Strategy: Compilation or Build Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation MIT-32
Strategy: Environment Hardening
Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.