CVE-2020-15627: (0Day) CentOS Web Panel ajax_mail_autoreply account SQL Injection Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root. Was ZDI-CAN-9738.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of CentOS Web Panel. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajaxmailautoreply.php. When parsing the account parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose information in the context of root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15627?
CVE-2020-15627 has a medium severity rating, indicating a moderate level of risk to affected systems.
How do I fix CVE-2020-15627?
To mitigate CVE-2020-15627, upgrade CentOS Web Panel to the latest version that addresses this vulnerability.
What versions of CentOS Web Panel are affected by CVE-2020-15627?
CVE-2020-15627 specifically affects CentOS Web Panel version 0.9.8.923.
Can CVE-2020-15627 be exploited without authentication?
Yes, CVE-2020-15627 can be exploited by remote attackers without requiring authentication.
What type of vulnerability is CVE-2020-15627?
CVE-2020-15627 is a sensitive information disclosure vulnerability located within ajax_mail_autoreply.php.