CVE-2023-53895 Details

An improper access control vulnerability has been identified in PimpMyLog version 1.7.14. This vulnerability allows remote attackers to create admin accounts without authorization through the application's configuration endpoint. Exploitation involves injecting malicious JavaScript into the unsanitized username field, which can be used to create a hidden backdoor account. Once the backdoor account is established, attackers may access sensitive server-side log information and environmental variables. The vulnerability arises from inadequate validation of user input, particularly in the username field, which is exploited to inject harmful scripts that could be executed later.