CVE-2020-29472
📋 TL;DR
CVE-2020-29472 is a SQL injection vulnerability in EGavilan Media's Under Construction page with cPanel 1.0 plugin. Attackers can exploit this to gain admin panel access and execute arbitrary code remotely. Organizations using this specific plugin version are affected.
💻 Affected Systems
- EGavilan Media Under Construction page with cPanel
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Unauthorized admin access leading to website defacement, data exfiltration, or malware injection.
If Mitigated
Limited impact with proper network segmentation and monitoring detecting exploitation attempts.
🎯 Exploit Status
Public exploit code is available, making this easily exploitable by attackers with basic skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.1 or later
Vendor Advisory: https://www.egavilanmedia.com/security-advisory-cve-2020-29472
Restart Required: No
Instructions:
1. Log into cPanel. 2. Navigate to plugin management. 3. Update 'Under Construction page with cPanel' to version 1.0.1 or later. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Disable vulnerable plugin
linuxTemporarily disable the Under Construction page plugin until patched
cpanel-plugin-manager --disable under-construction-cpanel
Web Application Firewall rule
allBlock SQL injection patterns targeting the vulnerable endpoint
Add WAF rule: deny requests containing SQL injection patterns to /cpanel/under-construction endpoint
🧯 If You Can't Patch
- Remove the plugin completely from all affected systems
- Implement strict network segmentation to isolate affected systems from critical assets
🔍 How to Verify
Check if Vulnerable:
Check cPanel plugin list for 'Under Construction page with cPanel' version 1.0Check Version:
cpanel-plugin-manager --list | grep 'under-construction-cpanel'Verify Fix Applied:
Verify plugin version shows 1.0.1 or later in cPanel plugin manager📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in web server logs
- Multiple failed login attempts followed by successful admin access
- Requests to /cpanel/under-construction with SQL syntax
Network Indicators:
- Outbound connections from cPanel server to unknown IPs
- Unusual database query patterns
SIEM Query:
source="web_logs" AND uri="/cpanel/under-construction" AND (query CONTAINS "UNION" OR query CONTAINS "SELECT *" OR query CONTAINS "--")🔗 References
- https://systemweakness.com/cve-2020-29472-under-construction-page-with-cpanel-1-0-sql-injection-18a6508c9683
- https://www.exploit-db.com/exploits/49150
- https://systemweakness.com/cve-2020-29472-under-construction-page-with-cpanel-1-0-sql-injection-18a6508c9683
- https://www.exploit-db.com/exploits/49150
