183 matches found
CVE-2015-4118
ISPConfig 3.x before 3.0.5.4p7 contains an SQL injection in monitor/show_sys_state.php that can be exploited by remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. The issue arises from improper handling of the server parameter in the vu...
PT-2015-6420
Name of the Vulnerable Software and Affected Versions ISPConfig versions prior to 3.0.5.4p7 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that create...
PT-2015-6419
Name of the Vulnerable Software and Affected Versions ISPConfig versions prior to 3.0.5.4p7 Description The issue allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter in the "monitor/show sys state.php" file. This can potentially be...
CVE-2015-4118: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in monitor/showsysstate.php in ISPConfig before 3.0.5.4p7 allows remote authenticated users with monitor permissions to execute arbitrary SQL commands via the server parameter. NOTE: this can be leveraged by remote attackers using CVE-2015-4119.2...
CVE-2015-4119: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in ISPConfig before 3.0.5.4p7 allow remote attackers to hijack the authentication of 1 administrators for requests that create an administrator account via a request to admin/usersedit.php or 2 arbitrary users for requests that conduct SQL...
Multiple Vulnerabilities in ISPConfig
Advisory ID: HTB23260 Product: ISPConfig Vendor: http://www.ispconfig.org Vulnerable Versions: 3.0.5.4p6 and probably prior Tested Version: 3.0.5.4p6 Advisory Publication: May 20, 2015 without technical details Vendor Notification: May 20, 2015 Vendor Patch: June 4, 2015 Public Disclosure: June 1...
ISPConfig '/admin/users_edit.php' cross-site request forgery vulnerability
ISPConfig is a set of Linux-based open source hosting control panel, it can be used through the Web control panel to manage multiple servers, open a Web site, monitor server operating conditions and so on. ISPConfig suffers from a cross-site request forgery vulnerability that allows remote...
ISPConfig 3.0.5.4p6 SQL Injection / Cross Site Request Forgery
Advisory ID: HTB23260 Product: ISPConfig Vendor: http://www.ispconfig.org Vulnerable Versions: 3.0.5.4p6 and probably prior Tested Version: 3.0.5.4p6 Advisory Publication: May 20, 2015 without technical details Vendor Notification: May 20, 2015 Vendor Patch: June 4, 2015 Public Disclosure: June 1...
ISPConfig 3.0.5.4p6 - Multiple Vulnerabilities
ISPConfig 3.0.5.4p6 - Multiple Vulnerabilities Advisory ID: HTB23260 Product: ISPConfig Vendor: http://www.ispconfig.org Vulnerable Versions: 3.0.5.4p6 and probably prior Tested Version: 3.0.5.4p6 Advisory Publication: May 20, 2015 without technical details Vendor Notification: May 20, 2015 Vendo...
ISPConfig 3.0.5.4p6 SQL Injection / Cross Site Request Forgery Vulnerabilities
ISPConfig version 3.0.5.4p6 suffers from cross site request forgery and remote SQL injection vulnerabilities. Product: ISPConfig Vendor: http://www.ispconfig.org Vulnerable Versions: 3.0.5.4p6 and probably prior Tested Version: 3.0.5.4p6 Advisory Publication: May 20, 2015 without technical detail...
ISPConfig 3.0.5.4p6 - Multiple Vulnerabilities
Advisory ID: HTB23260 Product: ISPConfig Vendor: http://www.ispconfig.org Vulnerable Versions: 3.0.5.4p6 and probably prior Tested Version: 3.0.5.4p6 Advisory Publication: May 20, 2015 without technical details Vendor Notification: May 20, 2015 Vendor Patch: June 4, 2015 Public Disclosure: June 1...
ISPConfig 3.0.54p1 - Authenticated Admin Local root Vulnerability
No description provided by source. Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability Date: 7/25/14 Exploit Author: mra Vendor Homepage: http://wwwispconfig.org Version: 3.0.54p1 Tested on: ubuntu, centos irc.criten.net elite-chat While logged in as admin user: 1 add a shell...
ISPConfig 3.0.54p1 - Authenticated Admin Local root Vulnerability
Exploit for linux platform in category web applications While logged in as admin user: 1 add a shell user 2 under option set gid to ispconfig 3 log in as that user 4 edit /usr/local/ispconfig/interface/lib/lang/en.lng with system$GET'cmd'; 5 browse to: http://server:8080/index.php?cmd=echo...
ISPConfig 3.0.54p1 - (Authenticated) Admin Privilege Escalation
ISPConfig 3.0.54p1 - Authenticated Admin Privilege Escalation Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability Date: 7/25/14 Exploit Author: mra Vendor Homepage: http://wwwispconfig.org Version: 3.0.54p1 Tested on: ubuntu, centos irc.criten.net elite-chat While logged in as...
ISPConfig 3.0.54p1 - (Authenticated) Admin Privilege Escalation
Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability Date: 7/25/14 Exploit Author: mra Vendor Homepage: http://wwwispconfig.org Version: 3.0.54p1 Tested on: ubuntu, centos irc.criten.net elite-chat While logged in as admin user: 1 add a shell user 2 under option set gid to...
ISPConfig 3.0.54p1 Local Root
Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability Date: 7/25/14 Exploit Author: mra Vendor Homepage: http://wwwispconfig.org Version: 3.0.54p1 Tested on: ubuntu, centos irc.criten.net elite-chat While logged in as admin user: 1 add a shell user 2 under option set gid to...
ISPConfig 2.2.3 - Multiple Remote File Include Vulnerabilities
No description provided by source...
ISPConfig Authenticated Arbitrary PHP Code Execution
No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit4 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def...
ISPConfig Authenticated Arbitrary PHP Code Execution (CVE-2013-3629)
A code execution vulnerability has been reported in ISPConfig. The vulnerability is due to a flaw in the /content.php script that is triggered when parsing language files. An attacker could trigger this flaw via a specially crafted language file. Successful exploitation of this vulnerability coul...