CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated remote attackers to exploit the billing module handler in Softaculous Virtualizor versions prior to 3.2.9 and 3.0.0, enabling them to execute arbitrary commands as root. By manipulating the billing_data POST field, attackers can inject shell commands, gaining full control over the host and all virtual private servers managed by it. Organizations using affected versions should prioritize patching this critical vulnerability to mitigate the risk of unauthorized access and potential system compromise.
Original NVD Description
Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.