ZDI-23-1476: (0Day) Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The specific flaw exists within the mysqlmanager module. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-42123.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-23-1476?
The severity of ZDI-23-1476 is critical as it allows remote attackers to execute arbitrary code.
How do I fix ZDI-23-1476?
To fix ZDI-23-1476, ensure that you update to the latest version of Control Web Panel that addresses this vulnerability.
What is the affected software for ZDI-23-1476?
The affected software for ZDI-23-1476 is Control Web Panel.
Is authentication required to exploit ZDI-23-1476?
Yes, authentication is required to exploit the vulnerability identified as ZDI-23-1476.
What module is vulnerable in ZDI-23-1476?
The vulnerable module in ZDI-23-1476 is the mysql_manager module.