Support Us — Your donation helps us keep running

Goal: 1000 CNY，Raised: 1000 CNY

100.0%
Donate Now
I. Basic Information for CVE-2023-5002
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Pgadmin4: remote code execution by an authenticated user
Source: NVD (National Vulnerability Database)
Vulnerability Description
A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code executed on this API, allowing an authenticated user to run arbitrary commands on the server.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
pgAdmin 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pgAdmin是一个用于开源数据库 PostgreSQL 的开源管理和开发平台。 pgAdmin 存在安全漏洞，该漏洞源于无法正确控制在此 API 上执行的服务器代码，从而允许经过身份验证的用户在服务器上运行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
II. Public POCs for CVE-2023-5002
#POC DescriptionSource LinkShenlong Link
1Nonehttps://github.com/Threekiii/Awesome-POC/blob/master/Web%E5%BA%94%E7%94%A8%E6%BC%8F%E6%B4%9E/pgAdmin%20%E2%89%A4%207.6%20%E5%90%8E%E5%8F%B0%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2023-5002.mdPOC Details
2https://github.com/vulhub/vulhub/blob/master/pgadmin/CVE-2023-5002/README.mdPOC Details
AI-Generated POCPremium

No public POC found.

Login to generate AI POC
III. Intelligence Information for CVE-2023-5002
Please Login to view more intelligence information
New Vulnerabilities
Same weakness: CWE-78
V. Comments for CVE-2023-5002

No comments yet

Leave a comment