ZPanel <= 10.0.0.2 htpasswd Module Username Command Execution

A remote command execution vulnerability exists in ZPanel version 10.0.0.2 in its htpasswd module. When creating .htaccess files, the inHTUsername field is passed unsanitized to a system() call that invokes the system’s htpasswd binary. By injecting shell metacharacters into the username field, an authenticated attacker can execute arbitrary system commands. Exploitation requires a valid ZPanel account—such as one in the default Users, Resellers, or Administrators groups—but no elevated privileges.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

zpanelx 安全漏洞

zpanelx是The ZPanel Project开源的一个web托管控制面板。 zpanelx 10.0.0.2版本存在安全漏洞，该漏洞源于htpasswd模块输入清理不足，可能导致远程代码执行。

N/A

N/A