Cyber Resilience

CVE-2023-30258

CriticalPublic PoCRCE

Published: 23 June 2023

Published
23 June 2023
Modified
29 August 2025
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9371 99.9th percentile
Risk Priority 76 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-30258 is a critical-severity OS Command Injection (CWE-78) vulnerability in Magnussolution Magnusbilling. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

CVE-2023-30258 is a command injection vulnerability present in MagnusSolution MagnusBilling versions 6.x and 7.x. The flaw, tracked under CWE-78 and CWE-77, permits execution of arbitrary operating-system commands through specially crafted unauthenticated HTTP requests and carries a CVSS v3.1 base score of 9.8.

Remote attackers can exploit the issue over the network without credentials or user interaction, achieving full control over the affected billing application and underlying host. Public exploit material, including ready-to-use code on PacketStorm, has been available since disclosure.

A corrective commit was merged into the official magnusbilling7 repository, and an independent advisory published at eldstal.se outlines the affected endpoints and recommended remediation steps.

The CVE maintains an EPSS score of 0.9371 (peak 0.9375), indicating sustained and elevated exploitation interest.

EU & UK References

Vulnerability details

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

magnussolution
magnusbilling
6.0.0 — 7.3.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References