TI-2013-06178 Aliases CVE-2013-10035 GHSA-q65g-898q-8jpw

ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution

HIGH 73CWE-94Published 2025-07-31 · Updated 2026-05-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0249 84th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA

Fix Fixed ProcessMaker Open Source (ProcessMaker, Inc.): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ProcessMaker	ProcessMaker Open Source	2.0 to before 2.5.2	2.5.2	Patch available	CNA

ProcessMaker Open Source VendorProcessMaker Affected 2.0 to before 2.5.2 Fixed in 2.5.2 Patch available CNA

Remediation

Fix · CNA ProcessMaker Open Source (ProcessMaker, Inc.) Fixed in 2.5.2

Timeline

2026-10-02 Threatist record created from CVE-2013-10035
2026-10-03 Alias added: GHSA-q65g-898q-8jpw

References

Exploit 2

Patch 1

https://web.archive.org/web/20150419043936/https://bugs.processmaker.com/view.php?id=13436

Advisory 1

https://www.fortiguard.com/encyclopedia/ips/37390

TI-2025-24257 ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE CVSS 4.0HIGH 8.6
TI-2021-22591 ProcessMaker 3.5.4 Local File Inclusion via Path Traversal CVSS 4.0MEDIUM 6.9
TI-2022-18153 ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user… CVSS 3.1HIGH 8.8
TI-2016-07407 Deserialization of untrusted data in ProcessMaker Enterprise CVSS 3.1HIGH 8.8
TI-2020-10605 SQL injection in ProcessMaker CVSS 3.1HIGH 8.8
TI-2020-10604 SQL injection in ProcessMaker CVSS 3.1HIGH 8.8

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences