vendor:
MyPHPCommander
by:
Cold z3ro
7.5
CVSS
HIGH
Remote Code Execution
94
CWE
Product Name: MyPHPCommander
Affected Version From: Not mentioned
Affected Version To: Not mentioned
Patch Exists: NO
Related CWE: CVE not mentioned
CPE: Not mentioned
Metasploit:
https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2022-23499/, https://www.rapid7.com/db/vulnerabilities/amazon_linux-cve-2022-3643/, https://www.rapid7.com/db/vulnerabilities/amazon-linux-ami-2-cve-2022-3643/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2022-3643/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2022-3643/, https://www.rapid7.com/db/vulnerabilities/ubuntu-cve-2022-3643/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2022-3172/, https://www.rapid7.com/db/vulnerabilities/alma_linux-cve-2021-20325/, https://www.rapid7.com/db/vulnerabilities/oracle_linux-cve-2021-20325/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2021-20325/, https://www.rapid7.com/db/vulnerabilities/redhat_linux-cve-2021-20325/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2021-37698/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2021-37698/, https://www.rapid7.com/db/vulnerabilities/oracle-solaris-cve-2020-25686/, https://www.rapid7.com/db/vulnerabilities/alma_linux-cve-2020-25686/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp3-cve-2020-25686/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp2-cve-2020-25686/, https://www.rapid7.com/db/vulnerabilities/debian-cve-2020-25686/, https://www.rapid7.com/db/vulnerabilities/redhat-openshift-cve-2020-25686/, https://www.rapid7.com/db/vulnerabilities/huawei-euleros-2_0_sp9-cve-2020-25686/, https://www.rapid7.com/db/?q=CVE+not+mentioned&type=&page=2, https://www.rapid7.com/db/?q=CVE+not+mentioned&type=&page=3, https://www.rapid7.com/db/?q=CVE+not+mentioned&type=&page=2
Platforms Tested: Not mentioned
2007
MyPHPCommander Remote Code Execution
The vulnerability exists in the package.php file of MyPHPCommander. It is caused by the insecure usage of the gl_root parameter, which can be exploited to execute arbitrary PHP code remotely. An attacker can inject a malicious command through the gl_root parameter, leading to remote code execution on the server.
Mitigation:
The vulnerability can be mitigated by updating to a patched version of MyPHPCommander or by removing the vulnerable package.php file. It is recommended to regularly update the software to prevent such vulnerabilities.
