CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
What the vulnerability does
Improper Control of Generation of Code ('Code Injection') vulnerability in Soflyy Oxygen Builder allows Code Injection. Vendor is ignoring report, refuses to patch the issue.This issue affects Oxygen Builder: from n/a through 4.9.
Explanation of Vulnerability in Simple Terms
Oxygen Builder versions up to 4.9 allow authenticated users with low privileges to inject and execute arbitrary PHP code on the site. The vulnerability stems from insufficient input validation in code processing functions. An attacker with a low-privilege account can execute malicious code with full site access, including reading sensitive data, modifying content, and disrupting service.
What an attacker can do
Run arbitrary PHP code on the site with full administrative capabilities.
Potential impact on your site
Complete site compromise: data theft, malware injection, defacement, and service disruption possible.
Conditions required to exploit
Attacker needs a low-privilege user account (e.g., subscriber or contributor role).
Key dates
External resources
Related vulnerabilities
