CVE-2008-2478
cPanel < 11.8.6 and < 11.23.1 - Authenticated Remote Code Execution via Email Address Field
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2008-2478. PoCs published by Ali Jasbi.
AI-analyzed exploit summary This exploit leverages a privilege escalation vulnerability in cPanel by manipulating the email address field during account creation to execute a Perl script that moves a file from a user's directory to the root directory. It demonstrates arbitrary file write capabilities leading to potential remote code execution.
Description
scripts/wwwacct in cPanel 11.18.6 STABLE and earlier and 11.23.1 CURRENT and earlier allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field (aka Email text box). NOTE: the vendor disputes this, stating "I'm unable to reproduce such an issue on multiple servers running different versions of cPanel.
Exploits (1)
This exploit leverages a privilege escalation vulnerability in cPanel by manipulating the email address field during account creation to execute a Perl script that moves a file from a user's directory to the root directory. It demonstrates arbitrary file write capabilities leading to potential remote code execution.