A publicly available vulnerability has been disclosed in cPanel & WHM This article explores cpanel credentials exploited. . This vulnerability allows authenticated hosting users to execute arbitrary database commands with full administrative privileges.
All currently supported versions of cPanel & WHM are affected until patched. That minimizes the exposure compared to the unauthenticated remote code execution bugs, but is still a serious issue in shared-hosting, reseller, managed-service and multi-tenant environments where users may have legitimate cPanel credentials and could still be exploited. Database admin access can have serious consequences . An intruder might gain access to sensitive application data such as customer information, configuration settings, authentication details, API keys, or password hashes stored by hosted websites.
This is particularly problematic in environments where MySQL or MariaDB servers are deployed with elevated filesystem permissions, lax plugin configurations or local integrations which can be abused after gaining administrative database privileges. - Administrators should upgrade their systems to one of the following patched versions: - cPanel/WHM 11.110.0.137 - cPanel/WHM 11.118.0.71 - cPanel/WHM 11.126.0.78 - cPanel/WHM 11.134.0.48 - cPanel/WHM 11.136.0.32 - WP Squared (WP2) version 138.1.6 is also affected. This feature should be disabled for low-trust, dormant, reseller and externally managed accounts by admins to reduce blind spots for SOC investigation and cost response and business disruptions with ANY.RUN.
