Pi-Hole Top Domains API Authenticated Exec

This exploits a command execution in Pi-Hole Web Interface API/Web inetrace page contains the field Top Domains/Top Advertisers which is validated by a regex which does not properly filter system commands, which can then be executed by calling the gravity functionality. However, the regex only...

CVE-2021-32706

creationtimestamp| type| source ---|---|--- 2021-08-04 23:23:43+00:00| seen| https://t.me/cibsecurity/26847 2022-01-12 15:41:13+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/piholedomainsapiexec.rb 2025-02-06 03:13:45+00:00| seen|...

CVE-2021-32706

Pi-hole Web Interface before 5.5.1 is vulnerable due to an unescaped period in the validDomainWildcard preg_match filter, allowing an attacker to bypass input validation and achieve remote code execution, directory listing, or sensitive file overwrites. A patch was released in version 5.5.1, whic...

CVE-2021-32706 (Authenticated) Remote Code Execution Possible in Web Interface 5.5

Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1, the validDomainWildcard pregmatch filter allows a malicious character through that can be used to execute code, list directories, and...