CVE-2013-10035
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-07-31

Last updated on: 2025-07-31

Assigner: VulnCheck

Description
A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-07-31
Last Modified
2025-07-31
Generated
2026-05-07
AI Q&A
2025-07-31
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
processmaker processmaker 2.0.23
processmaker processmaker 2.5.1
processmaker processmaker 2.5.0
processmaker processmaker 2.0.45
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is a code injection flaw in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code by sending crafted POST requests to certain endpoints (like appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php). These endpoints do not properly validate user input and directly call PHP functions such as system() with user-supplied parameters, allowing remote code execution. Exploitation requires valid user credentials and affects both Linux and Windows installations.


How can this vulnerability impact me? :

This vulnerability can allow an authenticated user to execute arbitrary PHP code on the server, potentially leading to full remote code execution. This can compromise the server's integrity, confidentiality, and availability, allowing attackers to manipulate data, disrupt services, or gain further access to the system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart