CVE-2024-39907: a sqlinjection in 1Panel

Modified

AliasesGHSA-5grx-v727-qmq6GO-2024-2990

Published 18-07-2024Last modified 02-08-2024

Vulnerability summary

CVE-2024-39907 is a critical (CVSS 9.8) vulnerability in 1panel-dev 1panel. EPSS estimates a 29.18% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

29.18%

0%100%

High · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1github

Timeline

18-07-2024
PublishedVulnerability first disclosed.
02-08-2024
Last modifiedVulnerability information updated.

Description

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.

CVSS metrics

4 scores · 3 sources · 2 versions

v4.09.3v3.19.8

EPSS trend

Probability

29.18%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 29.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

githubUnverified
1Panel
Maturity: poc

Weaknesses

CWE · root cause

CWE-89Improper Neutralization of Special Elements used in an SQL CommandThe product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

1panel-dev1 product

1panel≥ 1.10.9-tls, < 1.10.12-tls

Fit2cloud1 product

1panel≥ 1.10.9-lts, < 1.10.12-lts

Github.com/1Panel-dev1 product

1Panel< 1.10.12-tls | All versions (No fix recorded)

3 vendors · 3 products

References

4 links

github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6X Refsource CONFIRMWEBAdvisoryExploitThird Party Advisory
nvd.nist.gov/vuln/detail/CVE-2024-39907Advisory
github.com/1Panel-dev/1Panel/commit/ff549a47937c1314e6ee08453a1d2128242440cdWEBFIX
github.com/1Panel-dev/1PanelPACKAGE