CVE-2023-30258

🗓️ 23 Jun 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 226 Views🌐 WEB

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request

Reporter	Title	Published	Views	Family All 27
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	7 Dec 202511:28	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	13 Jul 202512:53	–	githubexploit
GithubExploit	Exploit for Command Injection in Magnussolution Magnusbilling	25 Feb 202603:19	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	25 Mar 202516:00	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	8 Apr 202612:14	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	12 Mar 202510:27	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	18 Sep 202515:32	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	8 Apr 202612:14	–	githubexploit
0day.today	MagnusBilling Remote Command Execution Exploit	14 Nov 202300:00	–	zdt
BDU FSTEC	The vulnerability of the exec() function in the icepay.php script of the MagnusBilling VoIP system allows a hacker to execute arbitrary commands.	19 Apr 202500:00	–	bdu_fstec

NVD

Node

magnussolution magnusbillingRange6.0.0–7.3.0

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/175672/MagnusBilling-Remote-Command-Execution.html
github	www.github.com/magnussolution/magnusbilling7/commit/ccff9f6370f530cc41ef7de2e31d7590a0fdb8c3
github	www.github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-30258.md
eldstal	www.eldstal.se/advisories/230327-magnusbilling.html

Parameter	Position	Path	Description	CWE
apiURL	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
ic_merchantid	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
ic_amount	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
ic_currency	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
ic_description	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
ic_country	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
ic_language	request body	/payment	SSRF via API URL injection in payment endpoint to cause internal resource access	CWE-77, CWE-78
action	request body	/admin/config	Path traversal attempt to set logging directory via admin/config endpoint	CWE-77, CWE-78
directory	request body	/admin/config	Path traversal attempt to set logging directory via admin/config endpoint	CWE-77, CWE-78
enable_logging	request body	/admin/config	Path traversal attempt to set logging directory via admin/config endpoint	CWE-77, CWE-78

17 Jun 2026 05:54Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.9425

SSVC

cve-2023-30258 command injection magnussolution magnusbilling vulnerability remote attackers arbitrary commands http request unauthenticated