Xuebibibibibi

Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.10.12-tls Description: The issue is related to SQL injections in the 1Panel project, specifically with the orderBy parameter, which can lead to arbitrary file writes and ultimately to remote code execution (RCE). The vulnerability can be exploited by a remote attacker to gain unauthorized access to protected information and execute arbitrary code. The estimated number of potentially affected devices worldwide is not specified. There are no known workarounds for these issues. Recommendations: For versions prior to 1.10.12-tls, upgrade to version 1.10.12-tls or later to resolve the issue. As a temporary workaround, consider implementing strict whitelist filtering for the orderBy parameter to minimize the risk of exploitation. Restrict access to the vulnerable API endpoint, such as 'http://api:30455/api/v1/hosts/command/search', to minimize the risk of exploitation. Avoid using the `orderBy` parameter in the affected API endpoint until the issue is resolved.