CVEs-PoC/2021/CVE-2021-23420.md

CVE-2021-23420

Description

This affects the package codeception/codeception from 4.0.0 and before 4.1.22, before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.

POC

Reference

• https://github.com/JinYiTong/poc
• https://snyk.io/vuln/SNYK-PHP-CODECEPTIONCODECEPTION-1324585

Github

• https://github.com/n0-traces/cve_monitor