EDB-45822

PoC

CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting

view exploit source exploit_dbtype webappsauthor InfinitumITpublished 2018-11-13catalog exploit_db

exploited CVEs (3)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-18774US	medium6.1	4.75% (92nd)	Exploit	2018-11-20
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows XSS via the admin/index.php module parameter.
CVE-2018-18773US	high8.8	3.41% (89th)	Exploit	2018-11-20
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=rootpwd, as demonstrated by changing the root password.
CVE-2018-18772US	high8.8	3.48% (89th)	Exploit	2018-11-20
CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.