CVE-2013-10070
PHP-Charts v1.0 PHP Code Execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization. A remote attacker can exploit this flaw by crafting a request that injects arbitrary PHP code, resulting in command execution under the web server's context. The vulnerability allows unauthenticated attackers to execute system-level commands via base64-encoded payloads embedded in parameter names, leading to full compromise of the host system.
| CWE | CWE-95 |
| Vendor | php-charts |
| Product | php-charts |
| Published | Aug 5, 2025 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for php-charts php-charts
Be the first to know when new unknown vulnerabilities affecting php-charts php-charts are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
PHP-Charts / PHP-Charts
1.0
References
raw.githubusercontent.com: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/php_charts_exec.rb exploit-db.com: https://www.exploit-db.com/exploits/24201 exploit-db.com: https://www.exploit-db.com/exploits/24273 web.archive.org: https://web.archive.org/web/20130120234844/http://php-charts.com/ vulncheck.com: https://www.vulncheck.com/advisories/php-charts-php-code-execution
Credits
AkaStep