CVE-2023-28854
High
Description
nophp is a PHP web framework. Prior to version 0.0.1, nophp is vulnerable to shell command injection on httpd user. A patch was made available at commit e5409aa2d441789cbb35f6b119bef97ecc3986aa on 2023-03-30. Users should update index.php to 2023-03-30 or later or, as a workaround, add a function such as `env_patchsample230330.php` to env.php.
SeverityHigh
CVSS8.0
Exploit probability—
ProductNophp
PublishedApr 3, 2023
First seenApr 3, 2023
Weakness typeCWE-77Command injection
How to fix
Update
- nophp_project nophp0.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nophp_project nophp | v < 0.0.1 | 0.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.