PT-2018-14405 · Centos · Centos Web Panel

Published 2018-10-15 · Updated 2023-01-24 · CVE-2018-18322

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.480

Description The issue concerns Command Injection via shell metacharacters in the admin/index.php API endpoint, specifically in the service start, service restart, service fullstatus, or service stop parameters. This allows for potential command injection attacks.

Recommendations For version 0.9.8.480, consider disabling the service start, service restart, service fullstatus, and service stop parameters in the admin/index.php endpoint until a patch is available. Restrict access to the admin/index.php endpoint to minimize the risk of exploitation. Avoid using the service start, service restart, service fullstatus, and service stop parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-18322

Affected Products

Centos Web Panel

References · 6

• 🔥 https://0day.today/exploit/31304 · Exploit
• 🔥 https://exploit-db.com/exploits/45610 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18322 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18322 · Vendor Advisory
• https://seccops.com/centos-web-panel-0-9-8-480-multiple-vulnerabilities · Note
• https://t.me/cvenotify/42761 · Telegram Post