Dst Admin
CVE-2023-43270
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate.
AnalysisAI
dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate. Affected products include: Dst-Admin Project Dst-Admin.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.
A vulnerability has been found in dst-admin 1.5.0 and classified as critical. Rated high severity (CVSS 7.5), this vulne
A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. Rated high severity (CVSS 7.5), this vu
A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Rated high severity (CVSS 7.5), th
A vulnerability classified as critical was found in dst-admin 1.5.0. Rated high severity (CVSS 7.5), this vulnerability
Unauthenticated remote attackers can execute arbitrary commands on dst-admin versions up to 1.5.0 by manipulating the Na
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today