CVE-2023-30258: MagnusBilling OS Command Injection via Unauthenticated HTTP Request

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, combined with a very high EPSS score and public exploit code, makes this an urgent remote code execution risk.

What it is

MagnusBilling 6.x and 7.x contain an OS command injection flaw (CWE-78/CWE-77) that lets remote attackers execute arbitrary commands through an unauthenticated HTTP request. The vulnerability is trivially reachable over the network with no credentials or user interaction, making it a severe risk for any exposed instance.

Impact

An attacker can run arbitrary operating system commands on the server, leading to full compromise of the application and potentially the underlying host. This can result in data theft, service disruption, or use of the server as a pivot point.

Attack surface

The flaw is reached over the network via HTTP requests to the MagnusBilling web interface. No authentication or user interaction is required, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Public exploit code and a third-party advisory are referenced, and EPSS indicates a very high probability of exploitation (0.9425, 99.845th percentile). The CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is documented in this record.

What to do

• Apply the vendor patch referenced in the MagnusBilling7 commit ccff9f6370f530cc41ef7de2e31d7590a0fdb8c3 as soon as possible.
• Restrict network access to the MagnusBilling web interface using firewalls or VPNs so it is not exposed to untrusted networks.
• Review and harden any input handling that passes user-supplied data to system commands; avoid shell execution where possible.
• Monitor for and block exploitation attempts using the public proof-of-concept and advisory details.
• If patching is delayed, consider temporarily disabling or isolating the affected service.

Detection

• Inspect HTTP request logs for suspicious parameters or patterns that may indicate command injection attempts against MagnusBilling endpoints.
• Monitor server process creation for unexpected child processes spawned by the web server (e.g., shell commands, curl, wget).
• Use file integrity monitoring on web-accessible directories and system binaries to detect post-exploitation changes.
• Deploy network signatures or WAF rules targeting known exploit patterns from the public advisory and PoC.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.