lxcenter/kloxo

GitHub

github.com

groups.google.com

Releases7

Frequency4 days 16 hours

Last Release over 12 years ago

Stars119

From Kloxo HostInaBox, a light and efficient webhosting platform, to Kloxo Enterprise, a truly distributed hosting platform. Kloxo is a fully scriptable, distributed and a 100% object oriented hosting platform.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2014-125123 ↗	Jul 31, 2025Thursday, 31 July 2025, 15:15	—	—
An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the administrator’s password from the backend database. After recovering valid credentials, the attacker can authenticate to the Kloxo control panel and leverage the Command Center feature (display.php) to execute arbitrary operating system commands as root on the underlying host system. This vulnerability was reported to be exploited in the wild in January 2014.