zs1n/cve-2023-46818CVE-2023-46818 | PoC | ISPConfig 3.2.11p1
ISPConfig versions <= 3.2.11 are vulnerable to an authenticated PHP code injection vulnerability via the records[] parameter in the /admin/language_edit.php endpoint.
This endpoint does not properly validate user input. An attacker with valid credentials can submit a specially crafted request to the language editing functionality, injecting PHP code that gets written to a file on the server (commonly shell.php). This allows the attacker to execute arbitrary commands on the server, potentially leading to full system compromise. To mitigate this vulnerability, it is recommended to apply the latest ISPConfig updates and restrict access to the admin panel.
http://<target>/admin/language_edit.php — ISPConfig vulnerable endpoint
Run the exploit script CVE-2024-47533.py.
python3 CVE-2023-46818.py -u <url> -U <username> -P <password>
Upon successful execution, the reverse shell will connect back to the machine, granting the attacker remote access to the server.