Public Exploit Released for ISPConfig PHP Code Injection (CVE-2023-46818)

CVE-2023-46818 is a PHP code injection vulnerability impacting ISPConfig versions 3.2.11 and earlier. The vulnerability exists within the 'language_edit.php' script, which fails to properly sanitize the 'records[]' form field input. By leveraging high-privileged administrative credentials, an attacker can submit malicious PHP code through this parameter, leading to arbitrary code execution on the underlying server.

As of August 2026, proof-of-concept exploit code has been published and is actively circulating, significantly lowering the barrier for exploitation. The released exploit automates the authentication process, performs the code injection to drop a persistent 'sh.php' web shell, and establishes an interactive interface for remote command execution. Defenders should prioritize patching ISPConfig installations to versions beyond 3.2.11 and auditing administrative access logs for suspicious activity targeting language management endpoints.

Attack Chain

1. Attacker obtains or possesses valid administrative credentials for the ISPConfig management panel.
2. Attacker authenticates to the ISPConfig interface using the compromised high-privileged account.
3. Attacker navigates to the language management functionality, specifically interacting with 'language_edit.php'.
4. Attacker submits a POST request to 'language_edit.php' containing the malicious payload within the 'records[]' form field.
5. The server-side PHP script evaluates the injected payload, causing the creation of a malicious file, typically 'sh.php', on the file system.
6. The attacker interacts with the newly created 'sh.php' web shell to issue OS-level commands.
7. The web shell executes the commands and returns the output to the attacker, often delimited by custom markers.

Impact

Successful exploitation results in full Remote Code Execution (RCE) on the ISPConfig host. An attacker can use this access to exfiltrate sensitive data, manipulate server configurations, or pivot to internal network segments. Given the nature of ISPConfig as a hosting control panel, a compromise likely impacts all hosted websites, databases, and mail services managed by the application.

Recommendation

• Patch all ISPConfig instances to a version later than 3.2.11 immediately.
• Deploy the provided Sigma rule to detect POST requests to 'language_edit.php' containing suspicious characters associated with injection.
• Audit web server access logs for requests to 'sh.php' or other unexpected script files within the web root.
• Restrict access to the ISPConfig administrative panel to known-safe IP addresses using network-layer controls.