github - ghsa-vw7m-92hg-3cxx

GHSA-VW7M-92HG-3CXX

Vulnerability from github – Published: 2025-12-23 00:30 – Updated: 2025-12-23 00:30

Details

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the 'password' parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the 'password' POST parameter to execute commands with web server privileges.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2023-53963"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-22T22:16:00Z",
    "severity": "CRITICAL"
  },
  "details": "SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the \u0027password\u0027 parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the \u0027password\u0027 POST parameter to execute commands with web server privileges.",
  "id": "GHSA-vw7m-92hg-3cxx",
  "modified": "2025-12-23T00:30:31Z",
  "published": "2025-12-23T00:30:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53963"
    },
    {
      "type": "WEB",
      "url": "https://web.archive.org/web/20221207074555/https://www.sound4.com"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/51173"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection"
    },
    {
      "type": "WEB",
      "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2023-53963 (GCVE-0-2023-53963)

Vulnerability from cvelistv5 – Published: 2025-12-22 21:37 – Updated: 2025-12-22 22:03

Title

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection

Summary

Severity ?

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

VulnCheck

References

URL

Tags

	https://www.exploit-db.com/exploits/51173	exploit
	https://web.archive.org/web/20221207074555/https:…	product
	https://www.zeroscience.mk/en/vulnerabilities/ZSL…	third-party-advisory
	https://www.vulncheck.com/advisories/sound-impact…	third-party-advisory

Impacted products

Vendor

Product

Version

SOUND4 Ltd.

Impact/Pulse/First

Affected: Version 2: 1.1/2.15

SOUND4 Ltd.	Impact/Pulse Eco	Affected: 1.16
SOUND4 Ltd.	BigVoice4	Affected: 1.2
SOUND4 Ltd.	BigVoice2	Affected: 1.30
SOUND4 Ltd.	Stream	Affected: 1.1/2.4.29
Kantar Media	WM2	Affected: 1.11

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-53963",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-22T21:56:16.358655Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-22T22:03:29.168Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Impact/Pulse/First",
          "vendor": "SOUND4 Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "Version 2: 1.1/2.15"
            }
          ]
        },
        {
          "product": "Impact/Pulse Eco",
          "vendor": "SOUND4 Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1.16"
            }
          ]
        },
        {
          "product": "BigVoice4",
          "vendor": "SOUND4 Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1.2"
            }
          ]
        },
        {
          "product": "BigVoice2",
          "vendor": "SOUND4 Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1.30"
            }
          ]
        },
        {
          "product": "Stream",
          "vendor": "SOUND4 Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "1.1/2.4.29"
            }
          ]
        },
        {
          "product": "WM2",
          "vendor": "Kantar Media",
          "versions": [
            {
              "status": "affected",
              "version": "1.11"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"
        }
      ],
      "datePublic": "2022-09-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands through the \u0027password\u0027 parameter. Attackers can exploit the login.php and index.php scripts by injecting shell commands via the \u0027password\u0027 POST parameter to execute commands with web server privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-22T21:37:17.088Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "ExploitDB-51173",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/51173"
        },
        {
          "name": "SOUND4 Official Product Homepage",
          "tags": [
            "product"
          ],
          "url": "https://web.archive.org/web/20221207074555/https://www.sound4.com/"
        },
        {
          "name": "Zero Science Lab Disclosure (ZSL-2022-5738)",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5738.php"
        },
        {
          "name": "VulnCheck Advisory: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/sound-impactfirstpulseeco-x-unauthenticated-remote-command-injection"
        }
      ],
      "title": "SOUND4 IMPACT/FIRST/PULSE/Eco v2.x Unauthenticated Remote Command Injection",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2023-53963",
    "datePublished": "2025-12-22T21:37:17.088Z",
    "dateReserved": "2025-12-19T14:03:57.724Z",
    "dateUpdated": "2025-12-22T22:03:29.168Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-VW7M-92HG-3CXX

CVE-2023-53963 (GCVE-0-2023-53963)

Tags

Sightings

Nomenclature