Multiple vulnerabilities in ZPanel 10.0.1
Several vulnerabilties were discovered in ZPanel 10.0.1 during our pro bono security audit. The ZPanel team has addressed these issues in version 10.0.2 and it is advised to upgrade.
CVSS Score
Severity
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Advisory
| Application | ZPanel |
| Vulnerable Versions | 10.0.1 and earlier |
| Fixed In | 10.0.2 |
Background
ZPanel is a web-based hosting control panel that runs on Apache, PHP, and MySQL. It manages Apache, hMailServer, FileZilla Server, Postfix, Dovecot, ProFTPD, MySQL, PHP, Webalizer, RoundCube, phpMyAdmin, and phpSysInfo.
Description
Websec discovered multiple vulnerabilities in ZPanel 10.0.1 during a pro bono audit, including SQL injection, Cross-Site Scripting, arbitrary code execution, authentication bypass, and CSRF. The combined impact places a ZPanel-managed host fully under attacker control.
All findings were remediated in ZPanel 10.0.2. Operators of 10.0.1 or earlier should upgrade immediately.
Remediation
Upgrade to ZPanel 10.0.2.