CVE-2023-36992
📋 TL;DR
This vulnerability allows remote attackers to inject and execute arbitrary PHP code through the config editor in TravianZ admin pages. It affects TravianZ game server administrators who have exposed admin interfaces. Attackers can gain full control of affected servers.
💻 Affected Systems
- TravianZ
📦 What is this software?
Travianz by Travianz Project
Travianz by Travianz Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or use as attack platform
Likely Case
Webshell installation for persistent access and data exfiltration
If Mitigated
Limited impact if admin interface is properly firewalled and access controlled
🎯 Exploit Status
Exploitation requires admin credentials but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to newer TravianZ versions if available or implementing workarounds.
🔧 Temporary Workarounds
Restrict Admin Interface Access
linuxBlock external access to admin pages using firewall rules
iptables -A INPUT -p tcp --dport 80 -s ! 192.168.1.0/24 -j DROP # Example for internal only
Implement Strong Authentication
allAdd additional authentication layers before admin interface
htpasswd -c /etc/apache2/.htpasswd admin # Basic auth example
🧯 If You Can't Patch
- Move admin interface to internal network only with VPN access
- Implement web application firewall with PHP injection detection rules
🔍 How to Verify
Check if Vulnerable:
Check if running TravianZ 8.3.3 or 8.3.4 and admin config editor is accessibleCheck Version:
Check TravianZ version in admin panel or config filesVerify Fix Applied:
Test config editor for PHP injection by attempting safe payload like <?php echo 'test'; ?>📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to config editor endpoints
- PHP execution errors in web logs
- Admin login from unexpected IPs
Network Indicators:
- HTTP requests containing PHP tags to admin pages
- Outbound connections from web server to unknown destinations
SIEM Query:
source="web.log" AND (uri="/admin/config*" AND method="POST" AND (body="<?php" OR body="eval("))