PHP-Charts v1.0 PHP Code Execution
Vulnerability Description
PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution under the web server's context. The vulnerability allows unauthenticated attackers to execute system-level commands via base64-encoded payloads embedded in parameter names, leading to full compromise of the host system.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-10070
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- AkaStep
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/php_charts_exec.rb
- https://www.exploit-db.com/exploits/24201
- https://www.exploit-db.com/exploits/24273
- https://web.archive.org/web/20130120234844/http://php-charts.com/
- https://www.vulncheck.com/advisories/php-charts-php-code-execution
Affected Vendor
PHP-Charts
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.