CVE-2007-0850 scripts/cronscript.php in SysCP 1.2.15 and earlier includes and executes arbitrary PHP scripts that are referenced by the panel_cronscript table in the SysCP database, which allows attackers with data...
HighCVSS 7.5
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
scripts/cronscript.php in SysCP 1.2.15 and earlier includes and executes arbitrary PHP scripts that are referenced by the panel_cronscript table in the SysCP database, which allows attackers with database write privileges to execute arbitrary code by constructing a PHP file and adding its filename to this table.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| syscp team syscp | = 1.2.10 | No fix listed |
| syscp team syscp | = 1.2.15 | No fix listed |
References
- 33127 vdb-entry
- 24102 third-party-advisory
- 20070207 Ability to inject and execute any code as root in SysCP mailing-list
- 22454 exploit vdb-entry vendor-advisory
- www.syscp.org
- syscp-cronscript-code-execution(32330) vdb-entry