Threat database

CVE-2023-53944 is a high-severity path traversal vulnerability in EasyPHP Webserver version 14.1 that allows remote attackers with low privileges to bypass SecurityManager restrictions and access files outside the web root. Exploitation involves sending specially crafted GET requests containing encoded directory traversal sequences such as /.. %5c.. %5c, enabling unauthorized reading of sensitive system files like /windows/win.ini. No user interaction or authentication is required, and the vulnerability has a CVSS 4.0 base score of 7.1, indicating a significant risk. Although no known exploits are currently reported in the wild, the ease of exploitation and potential information disclosure make this a critical concern for affected deployments.

EPSS 1.0%VulnerabilityEasyphpGermanyFrance+5

EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting malicious payloads through the app_service_control parameter. Attackers can send POST requests to /index.php?zone=settings with crafted app_service_control values to execute commands with administrative privileges.

EPSS 6.4%VulnerabilityEasyphpGermanyFrance+6