high7.5Public exploit code
CVE-2013-4878
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for ph…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Plesk < 9.5.4 - Remote Command Execution2013-06-05 · remote · php · Verified
Impact
The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX, and Small Business Panel 10.x on UNIX, has an improper ScriptAlias directive for phppath, which makes it easier for remote attackers to execute arbitrary code via a crafted request, a different vulnerability than CVE-2012-1823.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Parallels | Parallels Plesk Panel | Versions 9.0, 9.2 |
| Parallels | Parallels Small Business Panel | Version 10.0 |