{"id":"CVE-2024-39907","aliases":["GHSA-5grx-v727-qmq6","GO-2024-2990"],"title":"1Panel has an SQL injection issue related to the orderBy clause","summary":"1Panel has an SQL injection issue related to the orderBy clause","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"1Panel-dev","product":"github.com/1Panel-dev/1Panel","ecosystem":"go","affected":["github.com/1Panel-dev/1Panel < 1.10.12-tls"],"patched":["github.com/1Panel-dev/1Panel 1.10.12-tls"],"published":"2024-07-18","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:16.337480120Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5grx-v727-qmq6","references":[{"url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39907"},{"url":"https://github.com/1Panel-dev/1Panel/commit/ff549a47937c1314e6ee08453a1d2128242440cd"},{"url":"https://github.com/1Panel-dev/1Panel"}],"tags":["osv","go","exploit-available"],"epss":0.29183,"epssPercentile":0.98086,"exploits":{"nuclei":["CVE-2024-39907"],"checkedAt":"2026-09-23T07:13:29.851Z"},"exploitAvailable":true,"ingestedAt":"2026-09-12T03:13:01.756Z","slug":"CVE-2024-39907","body":"## Overview\n\n### Summary\nThere are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs.\nThe proof is as follows\n\n### Details （one of them ）\n<img width=\"697\" alt=\"image\" src=\"https://github.com/1Panel-dev/1Panel/assets/129351704/895b7b43-9bc0-44b3-9c84-24c2dcc962da\">\n<img width=\"936\" alt=\"image\" src=\"https://github.com/1Panel-dev/1Panel/assets/129351704/1b8eb866-9865-4bef-a359-53335d709157\">\n<img width=\"684\" alt=\"image\" src=\"https://github.com/1Panel-dev/1Panel/assets/129351704/e865d6d0-7ecb-49f7-b4a2-f1b0bc407986\">\n\n\n### PoC\ncurl 'http://api:30455/api/v1/hosts/command/search' {\"page\":1,\"pageSize\":10,\"groupID\":0,\"orderBy\":\"**3**\",\"order\":\"ascending\",\"name\":\"a\"}\n<img width=\"664\" alt=\"image\" src=\"https://github.com/1Panel-dev/1Panel/assets/129351704/250d5a2a-cb32-44dc-9831-86dbc2f2b43f\">\nfor example as picture . just change orderby‘s num we can know How many columns does the data table have.Parameters require strict whitelist filtering\n\n### Impact\nRCE、data leak.\n\n\n## Affected packages\n\n- `github.com/1Panel-dev/1Panel < 1.10.12-tls`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/1Panel-dev/1Panel 1.10.12-tls`","depth":"abyssal","depthScore":72,"depthScoreParts":{"impact":53.9,"likelihood":5.8,"exploitation":12,"ransomware":0},"changes":[]}