A vulnerability and a weakness have been reported in SysCP, which can be exploited by malicious users to compromise a vulnerable system.

1) Directory names inside a user's home directory are not properly sanitised before being used. This can be exploited to execute arbitrary commands with root privileges via a cron script when the user protects this directory with the control panel.

The vulnerability is reported in version 1.2.15.

2) Due to the file "scripts/cronscript.php" not properly validating files from the database table "panel_cronscript" before including them, it is possible to insert and execute arbitrary PHP files with root privileges.

Successful exploitation requires access to the database.

The weakness is reported in versions 1.2.3 through 1.2.15.

Solution
Update to version 1.2.16.

Provided and/or discovered by
1) The vendor credits Daniel Schulte
2) The vendor credits Martin Burchert

Changelog
Further details available in Customer Area

Original Advisory
http://www.syscp.org/wiki/Security/SyscpOrgAbilityToInjectAndExecuteAnyCodeAsRootInSysCP

Deep Links
Links available in Customer Area