CVE-2023-0048
Lack of Input Sanitation Lead to Remote Code Execution
Last updated
Lack of Input Sanitation Lead to Remote Code Execution
Last updated
This vulnerability occur because there is no sanitation on user controlled input during the update configuration process. The input later, written to another .php file and this could lead to RCE.
Code Injection
(High)
daloRADIUS <= 1.3
Go to Config then go to Mail Settings
Change the From Email Address value to malicious payload, e.g ';phpinfo();$a='x
Go to config-mail.php or library/daloradius.conf.php to see executed code.
Injected code in library/daloradius.conf.php can be seen in image below
Executed code on config-mail.php can be seen in image below
Executed code on library/daloradius.conf.php can be seen in image below
daloRADIUS version: 1.3
2023-01-04: Vulnerability discovered.
2023-01-04: Vulnerability fixed.
2023-01-04: Vulnerability reported to the MITRE corporation.
2023-01-04: CVE has been assigned.
2023-01-04: Public disclosure of the vulnerability.
Achmad Zaenuri Dahlan Putra ()
