Arbitrary PHP Code Execution Vulnerability in ISPConfig by ISPConfig

CVE-2013-3629

Summary

The vulnerability in ISPConfig 3.0.5.2 allows remote attackers to execute arbitrary PHP code. This flaw arises from inadequate input validation, enabling an attacker to manipulate server-side scripts. Exploitation can lead to significant security breaches, including unauthorized access to sensitive data and overall server compromise. It is crucial for users of ISPConfig to apply the latest security patches and monitor their systems for any vulnerabilities related to this issue.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2013-3629
Created by Rapid7

References