critical9.8Public exploit code
CVE-2019-18418
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- ClonOs WEB UI 19.09 - Improper Access Control2019-10-25 · webapps · php
Impact
clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Clonos | Clonos | Version 19.09 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154986/ClonOs-WEB-UI-19.09-Improper-Access-Control.html
- https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability
- http://packetstormsecurity.com/files/154986/ClonOs-WEB-UI-19.09-Improper-Access-Control.html
- https://github.com/Andhrimnirr/ClonOS-WEB-control-panel-multi-vulnerability