CVE-2023-30258

🗓️ 23 Jun 2023 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 135 Views🌐 WEB

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request

Reporter	Title	Published	Views	Family All 26
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	7 Dec 202511:28	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	13 Jul 202512:53	–	githubexploit
GithubExploit	Exploit for Command Injection in Magnussolution Magnusbilling	25 Feb 202603:19	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	25 Mar 202516:00	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	8 Apr 202612:14	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	12 Mar 202510:27	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	18 Sep 202515:32	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Magnussolution Magnusbilling	8 Apr 202612:14	–	githubexploit
0day.today	MagnusBilling Remote Command Execution Exploit	14 Nov 202300:00	–	zdt
Circl	CVE-2023-30258	3 Nov 202320:01	–	circl

NVD

Node

magnussolution magnusbillingRange6.0.0–7.3.0

Source	Link
eldstal	www.eldstal.se/advisories/230327-magnusbilling.html
github	www.github.com/magnussolution/magnusbilling7/commit/ccff9f6370f530cc41ef7de2e31d7590a0fdb8c3
packetstormsecurity	www.packetstormsecurity.com/files/175672/MagnusBilling-Remote-Command-Execution.html
github	www.github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-30258.md

Parameter	Position	Path	Description	CWE
apiURL	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
ic_merchantid	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
ic_amount	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
ic_currency	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
ic_country	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
ic_language	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
merchantID	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
action	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
directory	request body	payment	Server-Side Request Forgery via apiURL parameter enabling internal host access through payment endpoints.	CWE-77, CWE-78
apiURL	request body	checkout	SSRF potential in multiple payment endpoints by injecting internal URLs via apiURL.	CWE-77, CWE-78

29 Aug 2025 15:15Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

EPSS0.93709

SSVC

cve-2023-30258 command injection magnussolution magnusbilling vulnerability remote attackers arbitrary commands http request unauthenticated