CVE-2020-29472
Description
EGavilan Media Under Construction page with cPanel 1.0 contains a SQL injection vulnerability. An attacker can gain Admin Panel access using malicious SQL injection queries to perform remote arbitrary code execution.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- EGavilan Media/Under Construction page with cPaneldescription
- Range: =1.0
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization and lack of parameterized queries in the admin login authentication logic allow SQL injection."
Attack vector
An attacker navigates to the admin login page at `/admin/login.php` and submits the payload `admin' or '1'='1` in both the User ID and Password fields [ref_id=1]. The application does not sanitize or parameterize these inputs before constructing SQL queries, allowing the injected payload to alter the query logic. The condition `'1'='1'` always evaluates to true, bypassing authentication and granting the attacker admin panel access without valid credentials [ref_id=1].
Affected code
The vulnerability exists in the admin login page at `/admin/login.php` of the Under Construction Page with cPanel 1.0 application [ref_id=1]. The exact file and function responsible for handling authentication are not specified in the advisory, but the login form accepts unsanitized user input for both the User ID and Password fields [ref_id=1].
What the fix does
No patch or official fix is provided in the advisory [ref_id=1]. The remediation guidance implied by the disclosure is to implement parameterized queries (prepared statements) or proper input sanitization on the login form fields to prevent SQL injection. Without such changes, the authentication mechanism remains vulnerable to the trivial `' or '1'='1` bypass [ref_id=1].
Preconditions
- networkThe admin login page must be accessible at /admin/login.php
- configThe application must be running the vulnerable version (1.0) of Under Construction Page with cPanel
- configNo authentication or WAF protection must be in place on the login endpoint
Reproduction
1. Open the admin login page at `http://localhost/Under%20Construction/admin/login.php`. 2. Enter the payload `admin' or '1'='1` in both the User ID and Password fields. 3. Submit the form; the server accepts the payload and grants admin panel access without valid credentials [ref_id=1].
Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- systemweakness.com/cve-2020-29472-under-construction-page-with-cpanel-1-0-sql-injection-18a6508c9683mitrex_refsource_MISC
- www.exploit-db.com/exploits/49150mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.