MyLittleAdmin has a big security flaw

guest · May 19, 2020

MyLittleAdmin has a big, unpatched security flaw
Hardcoded key creates zero-day RCE vulnerability
May 19, 2020
https://portswigger.net/daily-swig/mylittleadmin-has-a-big-unpatched-security-flaw

An unpatched remote code execution (RCE) vulnerability in MyLittleAdmin creates a ready mechanism for unauthenticated attackers to assault hosting environments.
MyLittleAdmin (MLA) is a web-based management tool tuned to the hosting industry and marketed by MyLittleTools.
Pretty big zero-day
The flaw in MyLittleAdmin stems from a reliance on default credentials, according to an advisory from SSD. [...] SSD’s advisory explains.
Even though MyLittleAdmin is no longer being actively developed, the technology is still widely used, SSD told The Daily Swig.

“MLA still has thousands of active users,” a representative of SSD explained.
Click to expand...

Going public
MyLittleAdmin version 3.8 is confirmed as vulnerable. Older versions may also be exploitable, but this is unconfirmed.

SSD went public with an advisory, and proof of concept exploit, against MyLittleAdmin only after failing to get a response from its developers, MyLittleTools.
Click to expand...

Log in or Sign up

MyLittleAdmin has a big security flaw

guest Guest

Log in or Sign up

MyLittleAdmin has a big security flaw

guest Guest

Useful Searches