cbcvebase.
CVE-2015-4117
published 2018-02-28

CVE-2015-4117: Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to…

PriorityP265high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
11.21%
95.4th percentile
Vesta Control Panel before 0.9.8-14 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the backup parameter to list/backup/index.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
vestacpcontrol_panel< 0.9.8-140.9.8-14

Detection & IOCsextracted from sources · hover to see the quote

path/list/backup/index.php↗
path/tmp/sess_12345↗
port8083↗
  • →Monitor HTTP GET requests to /list/backup/index.php containing shell metacharacters (e.g., single quote, pipe '||', semicolons) in the 'backup' parameter, indicating OS command injection attempts. ↗
  • →Detect URL-encoded shell injection patterns in the 'backup' GET parameter, specifically '%27' (single quote) followed by '%20||%20' (pipe operator) sequences targeting /list/backup/index.php. ↗
  • →Alert on creation of PHP session files in /tmp/ (e.g., /tmp/sess_*) by the Vesta Control Panel process, which may indicate successful exploitation and session hijacking payload delivery. ↗
  • →Detect use of PHPSESSID=12345 cookie value in requests to Vesta Control Panel, which is the hardcoded session ID used in the published exploit for post-exploitation administrative access. ↗
  • ·The vulnerability is only exploitable by remote authenticated users — unauthenticated attackers cannot trigger the injection. Detection rules should account for authenticated sessions. ↗
  • ·Injected commands execute with privileges of the default Vesta Control Panel 'admin' account, meaning any registered (non-admin) client can escalate to full system compromise. ↗
  • ·Vesta Control Panel listens on port 8083 by default; detection rules targeting this CVE should include this non-standard port in scope. ↗

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.