CVE-2004-0529 The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain pri...
HighCVSS 7.2
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The modified suexec program in cPanel, when configured for mod_php and compiled for Apache 1.3.31 and earlier without mod_phpsuexec, allows local users to execute untrusted shared scripts and gain privileges, as demonstrated using untainted scripts such as (1) proftpdvhosts or (2) addalink.cgi, a different vulnerability than CVE-2004-0490.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cluecentral suexec.patch | All versions | No fix listed |
References
- bugzilla.cpanel.net
- 20040605 cPanel mod_php suEXEC Taint Vulnerability mailing-list
- 11798 third-party-advisory
- 1010411 vdb-entry
- 10478 vdb-entry vendor-advisory
- cpanel-suexec-command-execute(16347) vdb-entry