# CVE-2023-30258

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.

- Page: https://www.vulneraibility.com/cve/CVE-2023-30258
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 94.25% (percentile 99.9)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 11 GitHub proofs of concept · 1 Nuclei template (first 2024-01-27)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2024-12-05)
- Weakness: CWE-77
- Published: 2023-06-23

## Affected

- magnussolution:magnusbilling

## References

- [other] https://eldstal.se/advisories/230327-magnusbilling.html
- [other] https://github.com/magnussolution/magnusbilling7/commit/ccff9f6370f530cc41ef7de2e31d7590a0fdb8c3
- [other] http://packetstormsecurity.com/files/175672/MagnusBilling-Remote-Command-Execution.html
- [other] https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-30258.md

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.