CVE-2012-10022 Kloxo <= 6.1.12 Local Privilege Escalation
HighCVSS 8.5
EPSS 0.47%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48. The lxsuexec binary performs a uid check and permits execution of arbitrary commands as root if the invoking user matches uid 48. This flaw enables attackers with Apache-level access to escalate privileges to root without authentication.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| LxCenter Kloxo | <= 6.1.12 | No fix listed |
References
- raw.githubusercontent.com exploit
- www.exploit-db.com exploit
- web.archive.org exploit technical-description
- kloxo.org product
- github.com product
- www.vulncheck.com third-party-advisory