{"id":"CVE-2023-53888","aliases":["EUVD-2025-203421","GHSA-9g2h-fh68-3p2v"],"status":"published","title":"Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation","description":"Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00959,"percentile":0.6198,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2025-12-15T20:28:22Z","modified":"2026-06-17T06:46:15Z","products":[{"vendor":"zomp","product":"zomplog"},{"vendor":"zomplog","product":"zomplog"}],"references":[{"url":"https://www.exploit-db.com/exploits/51624","tags":["exploit","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/","tags":["product","Product"]},{"url":"https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53888"},{"url":"https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog"},{"url":"https://github.com/advisories/GHSA-9g2h-fh68-3p2v"}],"sources":{"cve":[{"id":"CVE-2023-53888","title":"Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation","description":"Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.","status":"published","published":"2025-12-15T20:28:22.684Z","modified":"2026-05-25T23:41:22.124Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:31.657022Z"}],"euvd":[{"id":"EUVD-2025-203421","description":"Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.","status":"published","published":"2025-12-15T20:28:22Z","modified":"2026-05-25T23:41:22Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:21:08.174412Z"}],"ghsa":[{"id":"GHSA-9g2h-fh68-3p2v","title":"Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to...","description":"Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload malicious JavaScript files, rename them to PHP, and execute system commands by exploiting the saveE and rename actions in the application.","status":"published","published":"2025-12-15T21:30:32Z","modified":"2025-12-24T18:31:18Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:05:22.018507Z"}],"nvd":[{"id":"CVE-2023-53888","description":"Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.","status":"published","published":"2025-12-15T21:15:51.973Z","modified":"2026-06-17T06:46:15.817Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:09:26.50087Z"}]}}