# N/A
## 概述
在 ISPConfig 3.2.11p1 之前的版本中，存在一个 PHP 代码注入问题。如果 `admin_allow_langedit` 选项被启用，管理员可以在语言文件编辑器中注入 PHP 代码。
## 影响版本
- ISPConfig 3.2.11p1 之前的版本
## 细节
如果 `admin_allow_langedit` 选项启用，管理员可以在语言文件编辑器中注入恶意 PHP 代码，导致远程代码执行。
## 影响
- 管理员账户可以利用此漏洞注入恶意 PHP 代码，可能导致远程代码执行。
- 服务器安全性和数据完整性可能受到威胁。
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2023-46818 IPSConfig Python exploit | https://github.com/bipbopbup/CVE-2023-46818-python-exploit | POC详情 |
| 2 | An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-46818.yaml | POC详情 |
| 3 | This is my own exploit for CVE-2023-46818 happy hacking! | https://github.com/blindma1den/CVE-2023-46818-Exploit | POC详情 |
| 4 | CVE-2023-46818 Python3 Exploit for ISPConfig <= 3.2.11 (language_edit.php) PHP Code Injection Vulnerability | https://github.com/ajdumanhug/CVE-2023-46818 | POC详情 |
| 5 | CVE-2023-46818 Python3 Exploit for Backdrop CMS <= 1.22.0 Authenticated Remote Command Execution (RCE) | https://github.com/ajdumanhug/CVE-2022-42092 | POC详情 |
| 6 | CVE-2023-46818 - ISPConfig PHP Code Injection PoC Exploit (Bash) | https://github.com/rvizx/CVE-2023-46818 | POC详情 |
| 7 | None | https://github.com/engranaabubakar/CVE-2023-46818 | POC详情 |
| 8 | An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled. | https://github.com/hunntr/CVE-2023-46818 | POC详情 |
| 9 | Metasploit Modules | https://github.com/SyFi/CVE-2023-46818 | POC详情 |
| 10 | Python PoC for CVE-2023-46818 | https://github.com/vulnerk0/CVE-2023-46818 | POC详情 |
暂无评论