PT-2017-14328 · Tpanel · Tpanel

Ihsan Sencan · Publicado 2017-10-29 · Atualizado 2017-11-16 · CVE-2017-15974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tPanel version 2009

Description The issue allows for SQL injection, which can be used for authentication bypass. This can be achieved by using specific input, such as 'or 1=1 or ''=', in the login process, potentially accessing the system without proper credentials. The vulnerability is exploited through the login.php endpoint.

Recommendations For tPanel version 2009, as a temporary workaround, consider restricting access to the login.php endpoint until a patch is available. Avoid using user-supplied input directly in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-15974

Produtos afetados

Tpanel

Referências · 4

• 🔥 https://exploit-db.com/exploits/43085 · Exploit
• 🔥 https://packetstormsecurity.com/files/144444/tPanel-2009-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15974 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-15974 · Aviso do Fabricante