Narin Boonwasanarak

19 exploits Active since Jul 2019
CVE-2019-13359 WRITEUP HIGH WRITEUP
Webpanel - Unrestricted File Upload
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
CVSS 7.5
CVE-2019-13383 WRITEUP MEDIUM WRITEUP
Webpanel - Information Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
CVSS 5.3
CVE-2019-13385 WRITEUP MEDIUM WRITEUP
Webpanel - Path Traversal
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.840, File and Directory Information Exposure in filemanager allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log.
CVSS 4.3
CVE-2019-13386 WRITEUP HIGH WRITEUP
CentOS Web Panel 0.9.8.846 - Remote Command Execution via filemanager2.php Hidden Action
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, a hidden action=9 feature in filemanager2.php allows attackers to execute a shell command, i.e., obtain a reverse shell with user privilege.
CVSS 8.8
CVE-2019-13387 WRITEUP MEDIUM WRITEUP
Webpanel - Cross-Site Scripting
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, Reflected XSS in filemanager2.php (parameter fm_current_dir) allows attackers to steal a cookie or session, or redirect to a phishing website.
CVSS 6.1
CVE-2019-13476 WRITEUP MEDIUM WRITEUP
Webpanel - Cross-Site Scripting
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, XSS in the domain parameter allows a low-privilege user to achieve root access via the email list page.
CVSS 5.4
CVE-2019-13477 WRITEUP HIGH WRITEUP
Webpanel - Cross-Site Request Forgery
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.837, CSRF in the forgot password function allows an attacker to change the password for the root account.
CVSS 8.8
CVE-2019-14721 WRITEUP MEDIUM WRITEUP
CentOS Web Panel 0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account.
CVSS 6.5
CVE-2019-14722 WRITEUP MEDIUM WRITEUP
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account.
CVSS 4.3
CVE-2019-14723 WRITEUP MEDIUM WRITEUP
CentOS Web Panel 0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account.
CVSS 4.3
CVE-2019-14724 WRITEUP HIGH WORKING POC
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account.
CVSS 7.5
CVE-2019-14725 WRITEUP MEDIUM WRITEUP
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.
CVSS 4.3
CVE-2019-14726 WRITEUP MEDIUM WRITEUP
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account.
CVSS 5.4
CVE-2019-14727 WRITEUP MEDIUM WRITEUP
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account.
CVSS 4.3
CVE-2019-14728 WRITEUP MEDIUM WRITEUP
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account.
CVSS 4.3
CVE-2019-14729 WRITEUP MEDIUM WRITEUP
CentOS Web Panel <0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account.
CVSS 4.3
CVE-2019-14730 WRITEUP MEDIUM WRITEUP
CentOS Web Panel 0.9.8.851 - Info Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account.
CVSS 4.3
CVE-2019-13383 EXPLOITDB MEDIUM text WRITEUP
Webpanel - Information Disclosure
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response.
CVSS 5.3
CVE-2019-13359 EXPLOITDB HIGH text WRITEUP
Webpanel - Unrestricted File Upload
In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.
CVSS 7.5