CVE-2013-10037

WebTester 5.x install2.php Unauthenticated Command Execution

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS —Not scored EPSS percentile96th14% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixNone yetNo fix or workaround published

Published 2025-07-31Updated 2025-07-31Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Eppler Software WebTesterAffected: 5.0Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run WebTester 5.x and whether the install2.php file is present on any web server.
Remove or block public access to install2.php immediately; installation files should not remain available after setup.
No fixed WebTester version has been published, so ask your vendor or IT provider for a supported replacement or remediation plan.
Review web-server logs for unusual requests to install2.php and investigate any suspicious activity.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cppassword, and cpdomain are passed directly to shell commands without sanitization. A remote unauthenticated attacker can exploit this flaw by sending a crafted HTTP POST request, resulting in arbitrary command execution on the underlying system with web server privileges.

In plain language

Written by AI from the record

WebTester 5.x has a serious flaw that can let an outsider take control of its server, so small businesses using it should act now.

Unauthenticated OS command injection (CWE-78) in WebTester 5.x install2.php allows crafted POST parameters to execute arbitrary commands with web-server privileges.

If you're affected

Server takeover
Website disruption
Data theft
Malware installation
Ransomware risk

What is it

This is a mistake in a WebTester setup file that can allow a stranger to send instructions to the server. It is like leaving a contractor’s master-key box outside after the building work is finished: someone could use it to get into the building and control what happens inside.

Who is affected

This matters to you if you run WebTester 5.x on a web server. It is especially important for systems where the installation process was never fully cleaned up; it is only a risk if install2.php is reachable by an attacker.

How urgent is it

A public exploit is available, meaning the instructions needed to attack this issue are already known. Treat this as an amber-priority issue: restrict access to the installation file promptly and have IT check the server for signs of misuse.

What to do — in detail

Confirm exposure by locating WebTester 5.x deployments and checking whether the installation script install2.php exists under the web-accessible application path. Test exposure from outside the network only with authorization; the relevant condition is whether an unauthenticated HTTP POST request can reach that script.

There are no vendor fixed versions or supported upgrade branches identified in the available findings. Remove the installation script after confirming installation is complete, or deny all web-server access to that path; if WebTester requires the file operationally, restrict it to a trusted administrative network or VPN and use web-server access controls.

If patching or replacement is delayed, place the application behind access restrictions and block requests to install2.php at the reverse proxy or web server. Review access and error logs for POST requests to that path, unexpected command-related errors, unfamiliar web-server child processes, and unexplained file or configuration changes. This CVE is not listed in CISA KEV, so no CISA remediation due date applies.

Technical context

CVE-2013-10037 is CWE-78 OS command injection in WebTester 5.x. The vulnerable install2.php installation endpoint passes the cpusername, cppassword, and cpdomain POST parameters to shell commands without sanitization, enabling remote unauthenticated arbitrary command execution with web-server privileges. A public exploit is available (one known), but the CVE is not in CISA KEV and the findings do not confirm exploitation in the wild. EPSS is 13.6% (96th percentile) and falling; this is a prediction, not evidence of observed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.