ISPConfig vulnerabilities

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter in delete and update methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding. A user with any low-privilege function permission can inject arbitrary SQL, delete or modify records across all tenants, and extract data including password hashes.

ISPConfig 3.3.0 is vulnerable to Cross Site Scripting (XSS) via the system status webpage. This allows an attacker to inject malicious scripts into the administrator's browser.