SQL Injection Vulnerability in Kloxo Web Hosting Control Panel by LXCenter
CVE-2014-125123
Key Information:
Badges
What is CVE-2014-125123?
An unauthenticated SQL injection vulnerability is present in the Kloxo web hosting control panel, affecting versions before 6.1.12. This flaw stems from improper input sanitization in the login-name parameter of the lbin/webcommand.php file. By exploiting this vulnerability, attackers can extract sensitive information, such as the administrator's password from the backend database. Once gaining access to the control panel, they can execute arbitrary commands on the host system as root, significantly compromising the server’s security. This issue was noted to be actively exploited in the wild as early as January 2014.
Affected Version(s)
Kloxo * < 6.1.12
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.