OpenPanel OS Command Injection Vulnerability in the Timezone Parameter
Vulnerability
A command injection vulnerability has been identified in OpenPanel version 0.3.4. This vulnerability allows remote execution of operating system commands through the timezone parameter.
Impact
Exploitation of this vulnerability allows for remote command execution on the server where OpenPanel 0.3.4 is installed.
Reproduction
To reproduce this vulnerability, send a POST request to the '/server/timezone' endpoint with a crafted payload in the timezone parameter. The payload can include OS commands, which will be executed on the server.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
10.0exploitability
8.7remediation
0.0relevance
0.0threat
6.5urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.