155 matches found
CVE-2023-46818
Metasploit-module Metasploit Module root@kitploit: use exploit/linux/http/ispconfiglanguageedit set RHOSTS target.com set USERNAME admin set PASSWORD password123 set LHOST 127.0.0.1 set LPORT 4444 exploit An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in...
CVE-2023-46818
CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash CVE-2023-46818 Authenticated PHP Code Injection in ISPConfig for more details: advisory CVE-2023-46818 PoC Introduction ISPConfig versions Note: This exploit requires valid ISPConfig admin credentials and will deploy a command web she...
CVE-2023-46818
CVE-2023-46818 ISPConfig - PHP Code Injection PoC Exploit Bash Introduction ISPConfig versions = 3.2.11 are vulnerable to an authenticated PHP code injection vulnerability via the records parameter in the /admin/languageedit.php endpoint. A malicious authenticated admin user can exploit this to...
ISPConfig - PHP Code Injection
An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled. id: CVE-2023-46818 info: name: ISPConfig - PHP Code Injection author: non-things severity: high description: | An issue was discovered...
CVE-2023-46818
CVE-2023-46818 Python Exploit ๐ฅ Description This Python exploit script targets a security vulnerability in ISPConfig's records POST parameter to /admin/languageedit.php, which is not properly sanitized. This allows an authenticated admin to inject and execute arbitrary PHP code. โ ๏ธ Affected...
CVE-2023-46818-python-exploit
CVE-2023-46818 exploit This is a python version of the original php script for the vulnerability affecting ispconfig 3.2.11 and previous versions. Original PHP source: https://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html This proof-of-concept is intended for...
CVE-2023-46818-Exploit
CVE-2023-46818-Exploit This is my own exploit for CVE-2023-46818 happy hacking! This exploit automates the attack described in CVE-2023-46818 by taking advantage of a PHP code injection vulnerability in ISPConfig version 3.2.11 and earlier. It logs into the ISPConfig panel using valid credentials...
CVE-2023-46818
CVE-2023-46818 ISPConfig 3.2.11p1 ์ด์ ๋ฒ์ ์์ ๋ฌธ์ ๊ฐ ๋ฐ๊ฒฌ๋์์ต๋๋ค. adminallowlangedit์ด ํ์ฑํ๋ ๊ฒฝ์ฐ ๊ด๋ฆฌ์๊ฐ ์ธ์ด ํ์ผ ํธ์ง๊ธฐ์์ PHP ์ฝ๋๋ฅผ ์ฝ์ ํ ์ ์์ต๋๋ค. ์ฌ์ฉ๋ฒ root@kitploit: โฏ python3 CVE-2023-46818.py Usage: python3 CVE-2023-46818.py Poc of CVE-2023-46818 ISPConfig = 3.2.11 - Code Injection Vulnerability by hunntr ์ฐธ๊ณ ์๋ฃ...
CVE-2023-46818
CVE-2023-46818 - ISPConfig PHP Code Execution | Exploit High Remote Code Execution in ISPConfig PoC implementation. Resume ISPConfig versions /admin/languageedit.php โ ISPConfig vulnerable endpoint ๐ Launching the Exploit...
CVE-2026-61518
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...
CVE-2026-61518
ISPConfig contains an authenticated SQL injection vulnerability in its Remote API . The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not ...
EUVD-2026-62663
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...
CVE-2026-61518 ISPConfig Authenticated SQL Injection via Remote API primary_id Parameter
ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primaryid parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The built-in SQL injection scanner does not...
PT-2026-78543
Name of the Vulnerable Software and Affected Versions ISPConfig affected versions not specified Description An authenticated SQL injection exists in the Remote API. The primary id parameter used in delete and update API methods is concatenated directly into SQL WHERE clauses without integer casti...
CVE-2025-52206
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting XSS via the system status webpage...
EUVD-2025-209641
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting XSS via the system status webpage...
CVE-2025-52206
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting XSS via the system status webpage...
CVE-2025-52206
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting XSS via the system status webpage...
CVE-2025-52206
ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. The vulnerability affects the ISPConfig system-status UI, specifically the monitor/show_sys_state.php endpoint (state=server&server=[removed]...), allowing reflected user-supplied input to execute script in...
