CVE-2023-38890

HIGH

Online Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-38890 has a selected CVSS score of 8.8 (high); EIP currently links 1 catalogued exploit and 2 repository PoCs.

Description

Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthorized access and potential data manipulation. This vulnerability arises due to insufficient validation of user-supplied input in the username field, enabling SQL Injection attacks.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
2

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 7, 2024 · Source: CVE List

Proofs of concept

3

Catalogued exploits

ExploitDBOnline Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)ExploitDB exploitby TagolettaNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubTagoletta/CVE-2023-38890Repository PoCby Tagoletta0Exploit2 files

3.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits CVE-2023-38890 in Online Shopping Portal 3.1 by performing SQL injection to bypass login, then uploading a PHP web shell via an authenticated file upload endpoint to achieve remote code execution.

Backdoor review

No backdoor observed in reviewed code

The repository contains a single Python script (CVE-2023-38890.py) that automates exploitation of CVE-2023-38890 against a target Online Shopping Portal 3.1 instance. The script performs SQL injection to bypass login, uploads a PHP web shell via a file upload vulnerability, and prints the shell path. All actions are directed at a user-supplied target URL and are consistent with the documented exploit chain. No concealed backdoor, unrelated payload, credential exfiltration, or persistence mechanism was observed.

ClassificationExploit
Model confidence95%
AuthenticationNot required
Languagespython
Target softwareOnline Shopping Portal Project 3.1
Attack typessql injectionunrestricted file uploadremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending a crafted SQL injection to bypass authentication, then uses the authenticated session to upload a PHP web shell, which is the definition of exploit code.

CVE-2023-38890.py:13-14CVE-2023-38890.py:26-27

Requirements

  • Target running Online Shopping Portal 3.1 with vulnerable login and file upload endpoints.CVE-2023-38890.py:5

Observed behavior

  • Prompts user for target URL.CVE-2023-38890.py:5
  • Sends SQL injection payload in username field to bypass admin login.CVE-2023-38890.py:12-14
  • Uploads a PHP web shell via multipart form data to insert-product.php, using authenticated session.CVE-2023-38890.py:24-27
  • Extracts the uploaded shell path by searching product listing and prints the full URL.CVE-2023-38890.py:29-33
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Web Shell Upload
Payload withheldThe script uploads a PHP web shell to the target server as part of the exploit chain. This is the intended exploit payload, not a backdoor against the PoC runner.CVE-2023-38890.py:6CVE-2023-38890.py:26
Sql Injection
Payload withheldThe script uses SQL injection in the login form to bypass authentication. This is part of the documented exploit for CVE-2023-38890.CVE-2023-38890.py:13
Target Url Input
Payload withheldThe script prompts the user for a target URL, indicating that all actions are directed at an external target, not the local machine running the PoC.CVE-2023-38890.py:5
Review boundaries

What the analysis did not establish

  • Evidence is limited to the supplied text files; no runtime behavior or network traffic was observed.
  • The script's success depends on the target application's exact endpoint paths and form field names, which are assumed but not verified.
  • Only the supplied text files were reviewed; no binary or non-text files were present.
  • The review does not assess whether the exploit works as claimed or whether the target application is actually vulnerable.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubakshadjoshi/CVE-2023-38890Repository PoCby akshadjoshi0Not analyzed1 file

1.0 KiB

GitHub
PoC details

References

4