What is CVE-2013-10037?

CVE-2013-10037 is a vulnerability in Eppler Software Webtester, classified under OS Command Injection. Published 2025-07-31.

Is CVE-2013-10037 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Eppler Software Webtester

CVE-2013-10037

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.096 (95.0th percentile) — read the EPSS interpretation.

Affected products

Eppler Software Webtester — versions 5.0

Weakness classification (CWE)

CWE-78 — OS Command Injection

Public proof-of-concept exploits

References

disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (exploit)
disclosure@vulncheck.com (third-party-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2013-10037?: CVE-2013-10037 is a vulnerability in Eppler Software Webtester, classified under OS Command Injection. Published 2025-07-31.
Is CVE-2013-10037 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.