CVE-2023-43835
📋 TL;DR
This vulnerability allows authenticated attackers to inject arbitrary PHP code into the config.inc.php file of Super Store Finder, leading to remote code execution. It affects Super Store Finder version 3.7 and below, requiring attacker authentication but enabling full system compromise.
💻 Affected Systems
- Super Store Finder
📦 What is this software?
Super Store Finder by Superstorefinder
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining root/system-level access, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Web server compromise leading to website defacement, data exfiltration, and use as a foothold for further attacks.
If Mitigated
Limited impact with proper authentication controls, file integrity monitoring, and restricted file permissions preventing successful exploitation.
🎯 Exploit Status
Exploit requires authenticated access but is straightforward with publicly available proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.8 or later
Vendor Advisory: https://packetstormsecurity.com/files/174756/Super-Store-Finder-3.7-Remote-Command-Execution.html
Restart Required: No
Instructions:
1. Download latest version from official source. 2. Backup current installation. 3. Replace all files with patched version. 4. Verify config.inc.php permissions are set to read-only.
🔧 Temporary Workarounds
Restrict config file permissions
linuxSet config.inc.php to read-only for web server user
chmod 444 config.inc.php
Disable vulnerable admin interface
allTemporarily disable admin access until patching
mv admin/ admin_disabled/
🧯 If You Can't Patch
- Implement strict authentication controls and monitor admin access logs
- Deploy web application firewall with RCE protection rules
🔍 How to Verify
Check if Vulnerable:
Check version number in admin panel or readme.txt fileCheck Version:
grep -i version readme.txt || cat admin/version.txtVerify Fix Applied:
Verify version is 3.8+ and config.inc.php has proper permissions (444)📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to admin settings pages
- File modification timestamps on config.inc.php
- Suspicious PHP code in config files
Network Indicators:
- HTTP requests with PHP code in parameters
- Outbound connections from web server to unknown IPs
SIEM Query:
source="web_logs" AND (uri_path="/admin/*" AND method="POST" AND (param="*php*" OR param="*system*" OR param="*exec*"))