CVE-2023-30805

PoC —

CVSS 3.1

9.8 critical

EPSS

66%p99

Published

Oct 10, 2023 (Oct 10, 2023)

Modified

Jun 17, 2026

Description

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling of shell meta-characters in the "un" parameter.

Vendors: sangfor
Products: next-gen application firewall
Weakness: CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (65.8%)

In the news0 stories

No ingested article mentions this CVE yet.