Cyber Resilience

CVE-2023-0935

MediumPublic PoC

Published: 21 February 2023

Published
21 February 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0510 90.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-0935 is a medium-severity OS Command Injection (CWE-78) vulnerability in Dolphinphp Project Dolphinphp. Its CVSS base score is 6.3 (Medium).

Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2023-0935 is an OS command injection vulnerability, tracked as CWE-78, that affects DolphinPHP versions up to 1.5.1. It resides in the common.php file within a component described as an incomplete fix for CVE-2021-46097; the flaw is triggered by unsanitized handling of the id argument and carries a CVSS 3.1 score of 6.3.

The issue can be exploited remotely by an authenticated attacker with low privileges. Successful exploitation permits the attacker to inject and execute operating-system commands, resulting in limited but concurrent impacts to confidentiality, integrity, and availability. Public exploit code has been released and may be reused.

The associated EPSS probability rose from a low baseline to a peak of 0.1649 on 2025-01-22 before receding to its current value of 0.0510, indicating that exploitation interest emerged after disclosure and that the CVE merits renewed attention.

EU & UK References

Vulnerability details

A vulnerability was found in DolphinPHP up to 1.5.1. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file common.php of the component Incomplete Fix CVE-2021-46097. The manipulation of the argument id leads…

more

to os command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221551.

CWE(s)
CWE-78

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

dolphinphp project
dolphinphp
≤ 1.5.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

SI-10 Information Input Validation
addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References