CVE-2013-10035

Status: DeferredHigh (8.7)—

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution.

Read full descriptionShow less

The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.

CVSS

Version: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Base score: 8.7

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 2.15%
Percentile among all scored CVEs: 81
Score date: 10/4/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1059 Command and Scripting Interpreterexecution90 %
Secondary impactT1068 Exploitation for Privilege Escalationprivilege escalation75 %

Vulnerabilidad de inyección de código PHP en endpoints remotos de ProcessMaker que requiere autenticación (PR:L). El atacante ejecuta comandos arbitrarios (system()) vía POST, escalando a root/admin. CVSS AV:N, VI:H confirman ejecución remota autenticada.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Threat Intelligence Program Privileged Account Management Execution Prevention Disable or Remove Feature or Program Application Isolation and Sandboxing Exploit Protection

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Processmaker — Processmaker Open Source^AI

CWEs

CWE-94

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2013-10035",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2013-10035",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-31T17:39:31.213961Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.7,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "ProcessMaker, Inc.",
          "modules": [
            "/appFolder/appFolderAjax.php",
            "/cases/casesStartPage_Ajax.php",
            "/cases/cases_SchedulerGetPlugins.php"
          ],
          "product": "ProcessMaker Open Source",
          "versions": [
            {
              "status": "affected",
              "version": "2.0",
              "lessThan": "2.5.2",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Windows",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-31T15:15:33.100",
  "references": [
    {
      "url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_exec.rb",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://web.archive.org/web/20150419043936/https://bugs.processmaker.com/view.php?id=13436",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/29325",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.fortiguard.com/encyclopedia/ips/37390",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/processmaker-open-source-neoclassic-skin-php-code-execution",
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de inyección de código en las versiones 2.x de código abierto de ProcessMaker al usar la interfaz predeterminada \"neoclassic\". Un usuario autenticado puede ejecutar código PHP arbitrario a través de múltiples endpoints, como appFolderAjax.php, casesStartPage_Ajax.php y cases_SchedulerGetPlugins.php, al proporcionar solicitudes POST manipuladas a parámetros como action y params. Estos endpoints no validan la entrada del usuario e invocan directamente funciones PHP como system() con parámetros proporcionados por el usuario, lo que permite la ejecución remota de código. La vulnerabilidad afecta tanto a instalaciones de Linux como de Windows y está presente en las configuraciones predeterminadas de las versiones 2.0.23 a 2.5.1. La interfaz vulnerable no se puede eliminar a través de la interfaz web, y para su explotación solo se requieren credenciales de usuario válidas."
    }
  ],
  "lastModified": "2026-06-16T23:50:34.667",
  "sourceIdentifier": "disclosure@vulncheck.com"
}