CVE-2023-53888

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53888
Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/ Product
https://www.exploit-db.com/exploits/51624 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation Exploit Third Party Advisory
https://www.exploit-db.com/exploits/51624 Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:zomp:zomplog:3.9:*:*:*:*:*:*:*
History

26 May 2026, 00:16

Type Values Removed Values Added
Summary (en) Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload malicious JavaScript files, rename them to PHP, and execute system commands by exploiting the saveE and rename actions in the application. (en) Zomplog 3.9 contains a remote code execution vulnerability that allows authenticated attackers to inject and execute arbitrary PHP code through file manipulation endpoints. Attackers can upload files (such as JavaScript) and rename them to .php via the saveE and rename actions, then execute the resulting PHP payload to run system commands.
References () https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation - Third Party Advisory, Exploit () https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation - Exploit, Third Party Advisory

24 Dec 2025, 18:11

Type Values Removed Values Added
First Time Zomp zomplog
Zomp
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CPE cpe:2.3:a:zomp:zomplog:3.9:*:*:*:*:*:*:*
References () https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/ - () https://web.archive.org/web/20080616153330/http://zomp.nl/zomplog/ - Product
References () https://www.exploit-db.com/exploits/51624 - () https://www.exploit-db.com/exploits/51624 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation - () https://www.vulncheck.com/advisories/zomplog-remote-code-execution-via-authenticated-file-manipulation - Third Party Advisory, Exploit

15 Dec 2025, 22:15

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/51624 - () https://www.exploit-db.com/exploits/51624 -

15 Dec 2025, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-15 21:15

Updated : 2026-05-26 00:16

NVD link : CVE-2023-53888

Mitre link : CVE-2023-53888

CVE.ORG link : CVE-2023-53888

JSON object : View

Products Affected

zomp

  • zomplog
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')