Attacker Value
Moderate
0

CVE-2020-13166

Disclosure Date: May 19, 2020

Exploitability

(1 user assessed) High
Attack Vector
Network
Privileges Required
None
User Interaction
None

Description

The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers’ installations) in web.config, and can be used to send serialized ASP code.

Add Assessment

1
Ratings
Technical Analysis

Metasploit exploit module PR’d here.

General Information

Additional Info

Technical Analysis