CVE-2023-30145

high-risk
Published 2023-05-26

Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.

Do I need to act?

!
53.3% chance of exploitation in next 30 days
EPSS score — higher than 47% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
51489
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Tuzitio

References (10)

Exploit http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Templ...
Exploit https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
Exploit https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share...
Exploit https://github.com/paragbagul111/CVE-2023-30145
Technical Description https://portswigger.net/research/server-side-template-injection
Exploit http://packetstormsecurity.com/files/172593/Camaleon-CMS-2.7.0-Server-Side-Templ...
Exploit https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
Exploit https://drive.google.com/file/d/11MsSYqUnDRFjcwbQKJeL9Q8nWpgVYf2r/view?usp=share...
Exploit https://github.com/paragbagul111/CVE-2023-30145
Technical Description https://portswigger.net/research/server-side-template-injection
62
/ 100
high-risk
Severity 32/34 · Critical
Exploitability 25/34 · High
Exposure 5/34 · Minimal