CVE ID | CVE-2020-15609 |
CVSS SCORE | 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
AFFECTED VENDORS |
CentOS Web Panel |
AFFECTED PRODUCTS |
CentOS Web Panel |
VULNERABILITY DETAILS |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_dashboard.php. When parsing the service_stop parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. |
ADDITIONAL DETAILS |
This vulnerability is being disclosed publicly without a patch in accordance with the ZDI 120 day deadline. 01/23/20 – ZDI reported the vulnerabilities to the vendor -- Mitigation: |
DISCLOSURE TIMELINE |
|
CREDIT | @PaulosYibelo & CasperTea |