CVE-2018-18324

Summary

CVE	CVE-2018-18324
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2018-10-15 07:29:00 UTC
Updated	2023-01-24 18:57:00 UTC
Description	CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has XSS via the admin/fileManager2.php fm_current_dir parameter, or the admin/index.php module, service_start, service_fullstatus, service_restart, service_stop, or file (within the file_editor) parameter.

Risk And Classification

Problem Types: CWE-79

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Centos-webpanel	Centos Web Panel	0.9.8.480	All	All	All
Application	Centos-webpanel	Centos Web Panel	0.9.8.480	All	All	All
Application	Control-webpanel	Webpanel	0.9.8.480	All	All	All

References

Reference	Source	Link	Tags
Access denied \| 0day.today used Cloudflare to restrict access	MISC	0day.today	Exploit, Third Party Advisory
Centos Web Panel 0.9.8.480 - Multiple Vulnerabilities - PHP webapps Exploit	EXPLOIT-DB	www.exploit-db.com	Exploit, Third Party Advisory, VDB Entry
CentOS Web Panel 0.9.8.480 Multiple Vulnerabilities - Seccops	MISC	seccops.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

730938 Centos Web Panel Multiple Vulnerabilities