https://www.exploit-db.com/exploits/23807
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-052

cPanel&WebHostManager(WHM)是WEB主机控制管理系统。cPanel在处理用户提交给登录脚本的数据时缺少充分过滤，远程攻击者可以利用这个漏洞以root用户权限在系统上执行任意命令。问题存在于登录脚本对用户提交’user’参数数据缺少充分过滤，可导致提交包含元字符的SHELL命令，可以root用户权限执行任意命令。

source: http://www.securityfocus.com/bid/9855/info

A potential remote command execution vulnerability has been discovered in the cPanel application. This issue occurs due to insufficient sanitization of externally supplied data to the login script. An attacker may exploit this problem by crafting a malicious URI request for the affected script; the attacker may then supply shell metacharacters and arbitrary commands as a value for the affected variable.

http://www.example.com.com:2082/login/?user=|"`id`"|

来源:US-CERTVulnerabilityNote:VU#831534
名称:VU#831534
链接:http://www.kb.cert.org/vuls/id/831534
来源:XF
名称:cpanel-login-execute-commands(15486)
链接:http://xforce.iss.net/xforce/xfdb/15486
来源:BID
名称:9855
链接:http://www.securityfocus.com/bid/9855
来源:SECUNIA
名称:11124
链接:http://secunia.com/advisories/11124
来源:BUGTRAQ
名称:20040312Cpanel9.1.0haveaproblem?
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107911581732035&w;=2