CVE-2024-39907

a sqlinjection in 1Panel

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.

Affected

1Panel-dev · 1Panel

CVSS v4.0 GitHub

9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

29.18% chance of exploitation in the next 30 days, 98th percentile

Nuclei

critical · CWE-89

Published

2024-07-18

Updated

2024-08-02

Proof-of-concept exploits (1)

• 1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-39907.yaml

Vulhub environments (1)

• vulhub/vulhub/tree/master/1panel/CVE-2024-39907

Security advisories

• advisories/GHSA-5grx-v727-qmq6

References

• CVE Record
• NVD entry