Lucene search

K
zdi@PaulosYibelo & CasperTeaZDI-20-754
HistoryJun 25, 2020 - 12:00 a.m.

(0Day) CentOS Web Panel ajax_admin_apis line Command Injection Remote Code Execution Vulnerability

2020-06-2500:00:00
@PaulosYibelo & CasperTea
www.zerodayinitiative.com
13

0.012 Low

EPSS

Percentile

85.4%

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

0.012 Low

EPSS

Percentile

85.4%

Related for ZDI-20-754