Skip to content
Threat Feed
Subscribe
critical advisory

Qualitor: Unauthenticated Remote Code Execution (CVE-2023-47253)

Qualitor versions 8.20 and earlier are vulnerable to unauthenticated remote code execution via PHP code injection into the gridValoresPopHidden parameter, with public proof-of-concept exploits available.

CVE search metadata

CVE search record: CVE-2023-47253. Severity: critical. CVSS: 9.8. EPSS: 14.31%. KEV: no. Product: Qualitor (<= 8.20). Brief: Qualitor: Unauthenticated Remote Code Execution (CVE-2023-47253). Brief link: https://feed.craftedsignal.io/briefs/2026-10-qualitor-rce/

Triage facts

Revision 1
Applicability
Qualitor (<= 8.20)
Evidence
Unknown
Severity
Critical
Action
Immediate escalation
Sources
2 public sources
Freshness
Revision 1Oct 28, 09:57 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B3Likely

Qualitor software (version 8.20 and earlier) contains a critical remote code execution (RCE) vulnerability identified as CVE-2023-47253. The vulnerability exists in the script '/html/ad/adpesquisasql/request/processVariavel.php', which passes user-controlled input from the 'gridValoresPopHidden' HTTP request parameter directly into a PHP eval() function. This allows an unauthenticated remote attacker to execute arbitrary PHP code on the underlying server.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary system commands, leading to full system compromise, data theft, and loss of integrity and availability.

Recommendation

  • Update all Qualitor instances to a version later than 8.20 immediately.
  • Review web server access logs for requests containing the 'gridValoresPopHidden' parameter targeting the '/html/ad/adpesquisasql/request/processVariavel.php' file.
  • Inspect server filesystem for evidence of webshells or unauthorized modifications, particularly in the directory containing the vulnerable script.

Immediate actions

Scan network perimeter for Qualitor instances running version 8.20 or lower.

SOC 24h

Mitigations

Upgrade to a version beyond 8.20 or disable the vulnerable script access if patching is not possible.

immediate IT Operations

CVE-2023-47253

Detection coverage 1

Detects CVE-2023-47253 Exploitation - Unauthenticated RCE

critical

Detects exploitation attempts against Qualitor by monitoring HTTP requests containing the vulnerable gridValoresPopHidden parameter in the processVariavel.php script.

sigma tactics: execution, initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →