This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: A PHP Code Injection flaw in ISPConfig's language editor. π₯ **Consequences**: Attackers can execute arbitrary PHP code, leading to full server compromise via web shells.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: Lack of input sanitization in the `records` POST parameter sent to `/admin/language_edit.php`. π‘ **CWE**: Improper Neutralization of Input During Web Page Generation (CWE-79).
Q3Who is affected? (Versions/Components)
π¦ **Affected**: ISPConfig versions **before 3.2.11p1**. π₯οΈ **Component**: The `language_edit.php` module within the admin panel.
Q4What can hackers do? (Privileges/Data)
π **Capabilities**: Hackers can inject malicious PHP payloads. β οΈ **Impact**: They can write web shells (e.g., `sh.php`) and gain **Remote Code Execution (RCE)** to run system commands.
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: **Medium**. Requires **Admin Authentication** AND the `admin_allow_langedit` setting must be **enabled**. π« Not remote unauthenticated.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Exploits**: **Yes**, multiple public PoCs exist. π Python scripts and Nuclei templates are available on GitHub for automated exploitation.
Q7How to self-check? (Features/Scanning)
π **Check**: Scan for ISPConfig versions < 3.2.11p1. π‘ Use Nuclei templates (`CVE-2023-46818.yaml`) to detect the vulnerable endpoint and configuration.
Q8Is it fixed officially? (Patch/Mitigation)
β **Fix**: Officially patched in **ISPConfig 3.2.11p1**. π₯ **Action**: Upgrade immediately to the latest stable version.
Q9What if no patch? (Workaround)
π **Workaround**: Disable the `admin_allow_langedit` feature in settings. π« Restrict admin panel access via firewall/WAF if upgrade is delayed.
Q10Is it urgent? (Priority Suggestion)
β‘ **Priority**: **High**. While auth is required, the ease of exploitation (RCE) and availability of automated tools make it critical to patch ASAP.