CVE-2020-37123

CRITICAL

9.8

Description

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/5/2026

Last Modified2/5/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-78

References

https://github.com/wcchandler/pinger(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/48323(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/pinger-remote-code-execution(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.