CVE-2023-30805

The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. A remote and unauthenticated attacker can execute arbitrary commands by sending a crafted HTTP POST request to the /LogInOut.php endpoint. This is due to mishandling of shell meta-characters in the "un" parameter.

• CWE-78
• CWE-78

• https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4Product
• https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/Exploit, Third Party Advisory
• https://vulncheck.com/advisories/sangfor-ngaf-username-rceThird Party Advisory
• https://aws.amazon.com/marketplace/pp/prodview-uujwjffddxzp4Product
• https://labs.watchtowr.com/yet-more-unauth-remote-command-execution-vulns-in-firewalls-sangfor-edition/Exploit, Third Party Advisory
• https://vulncheck.com/advisories/sangfor-ngaf-username-rceThird Party Advisory

Published

Oct 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3080The WP Mail Catcher plugin for WordPress is vulnerable to St…6.1
• CVE-2023-30800The web server used by MikroTik RouterOS version 6 is affect…7.5
• CVE-2023-30801All versions of the qBittorrent client through 4.5.5 use def…9.8
• CVE-2023-30802The Sangfor Next-Gen Application Firewall version NGAF8.0.17…5.3
• CVE-2023-30803The Sangfor Next-Gen Application Firewall version NGAF8.0.17…9.8
• CVE-2023-30804The Sangfor Next-Gen Application Firewall version NGAF8.0.17…6.5
• CVE-2023-30806The Sangfor Next-Gen Application Firewall version NGAF8.0.17…9.8
• CVE-2023-3081The WP Mail Logging plugin for WordPress is vulnerable to St…6.1
• CVE-2023-3082The Post SMTP plugin for WordPress is vulnerable to Stored C…6.1
• CVE-2023-3083Cross-site Scripting (XSS) - Stored in GitHub repository nil…8.7
• CVE-2023-30837Vyper is a pythonic smart contract language for the EVM. The…7.5
• CVE-2023-30838PrestaShop is an Open Source e-commerce web application. Pri…9.9