> For the complete documentation index, see [llms.txt](https://kos0ng.gitbook.io/notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kos0ng.gitbook.io/notes/research/2023/cve-2023-0048.md).
# CVE-2023-0048
## Vulnerability Explanation
This vulnerability occur because there is no **sanitation** on user controlled input during the update configuration process. The input later, written to another **.php** file and this could lead to **RCE**.
## Vulnerability Type
* Code Injection
## CVSS
* [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H](https://nvd.nist.gov/vuln/detail/CVE-2023-0048) (High)
## Vendor
* [daloRADIUS](https://www.daloradius.com/)
## Affected Version
* daloRADIUS **<= 1.3**
## Proof of Concept
1. Go to **Config** then go to **Mail Settings**
2. Change the From **Email Address** value to **malicious** payload, e.g `';phpinfo();$a='x`
3.
```
```
4. Go to **config-mail.php** or **library/daloradius.conf.php** to see executed code.
5. Injected code in **library/daloradius.conf.php** can be seen in image below
6.
```
```
7. Executed code on **config-mail.php** can be seen in image below
8.
```
```
9. Executed code on **library/daloradius.conf.php** can be seen in image below
10.
```
```
## Exploit Code
```python
# TBU
```
## Tested On
* daloRADIUS version: **1.3**
## Disclosure Timeline
* **2023-01-04:** Vulnerability discovered.
* **2023-01-04:** Vulnerability fixed.
* **2023-01-04:** Vulnerability reported to the MITRE corporation.
* **2023-01-04:** CVE has been assigned.
* **2023-01-04:** Public disclosure of the vulnerability.
## Researcher
* Achmad Zaenuri Dahlan Putra ([kos0ng](https://github.com/kos0ng))
## Additional Information
*
*