aapanel

aapanel aapanel 6.6.6 - CVE-2020-14950 描述：允许远程认证用户通过软件商店（Software Store）的设置菜单执行任意命令。 受影响版本：全部 = 6.6.6 信息 为了制作这个 PoC，我仅使用 docker-compose 安装了该软件。 漏洞类型：远程命令执行（认证后 RCE） PoC 前往软件商店，点击设置字段中的任意一行，在点击“启动/停止/重启”时拦截请求，然后修改/编辑该请求以执行您想要的操作。以下是一个使用 curl 的示例： aapanel 6.6.6 - CVE-2020-14421 描述：允许攻击者远程运行任意命令...

EUVD-2020-7085

Malware in sbrugna...

CVE-2020-14950

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

CVE-2020-14950

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

CVE-2020-14950

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

Design/Logic Flaw

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

CVE-2020-14950

CVE-2020-14950 affects aaPanel (up to version 6.6.6 and earlier). The vulnerability allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request under the Software Store settings menu. Root cause: insufficient validatio...