PT-2017-14328 · Tpanel · Tpanel

Ihsan Sencan · Published 2017-10-29 · Updated 2017-11-16 · CVE-2017-15974

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions tPanel version 2009

Description The issue allows for SQL injection, which can be used for authentication bypass. This can be achieved by using specific input, such as 'or 1=1 or ''=', in the login process, potentially accessing the system without proper credentials. The vulnerability is exploited through the login.php endpoint.

Recommendations For tPanel version 2009, as a temporary workaround, consider restricting access to the login.php endpoint until a patch is available. Avoid using user-supplied input directly in SQL queries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-15974

Affected Products

Tpanel

References · 4

• 🔥 https://exploit-db.com/exploits/43085 · Exploit
• 🔥 https://packetstormsecurity.com/files/144444/tPanel-2009-SQL-Injection.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-15974 · Security Note
• https://osv.dev/vulnerability/CVE-2017-15974 · Vendor Advisory