CVE-2023-53895
Published: 16 December 2025
Description
PimpMyLog 1.7.14 contains an improper access control vulnerability that allows remote attackers to create admin accounts without authorization through the configuration endpoint. Attackers can exploit the unsanitized username field to inject malicious JavaScript, create a hidden backdoor account, and potentially…
more
access sensitive server-side log information and environmental variables.
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations on the configuration endpoint to prevent unauthorized admin account creation.
Requires management processes that prohibit unauthorized creation of admin accounts, including backdoor accounts.
Validates inputs to the username field to block malicious JavaScript injection during account creation.
Security SummaryAI
CVE-2023-53895 is an improper access control vulnerability (CWE-285) in PimpMyLog version 1.7.14. The flaw resides in the configuration endpoint, which permits remote attackers to create admin accounts without any authorization. Additionally, the unsanitized username field allows injection of malicious JavaScript, enabling further compromise.
Remote attackers require only network access to exploit this vulnerability, with no privileges, user interaction, or special conditions needed (CVSS v3.1 score of 9.8: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation lets attackers create hidden backdoor admin accounts via JavaScript injection, potentially granting access to sensitive server-side log information and environmental variables.
Advisories and resources, including the VulnCheck advisory at https://www.vulncheck.com/advisories/pimpmylog-improper-access-control-via-account-creation-endpoint, the project site at https://www.pimpmylog.com/, and GitHub repository at https://github.com/potsky/PimpMyLog, provide details on mitigation. A public proof-of-concept exploit is documented at https://www.exploit-db.com/exploits/51593.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an improper access control flaw in a public-facing web application's configuration endpoint, allowing unauthenticated remote attackers to create admin accounts, directly enabling T1190: Exploit Public-Facing Application.