CVE-2014-125123

An unauthenticated SQL injection vulnerability exists in the Kloxo web hosting control panel (developed by LXCenter) prior to version 6.1.12. The flaw resides in the login-name parameter passed to lbin/webcommand.php, which fails to properly sanitize input, allowing an attacker to extract the administrator’s password from the backend database. After recovering valid credentials, the attacker can authenticate to the Kloxo control panel and leverage the Command Center feature (display.php) to execute arbitrary operating system commands as root on the underlying host system. This vulnerability was reported to be exploited in the wild in January 2014.

• CWE-89

• https://github.com/lxcenter/kloxo
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/kloxo_sqli.rb
• https://web.archive.org/web/20140301125222/http://www.webhostingtalk.com/showthread.php?p=8996984
• https://web.archive.org/web/20141118054734/https://vpsboard.com/topic/3384-kloxo-installations-compromised/
• https://www.exploit-db.com/exploits/31577
• https://www.vulncheck.com/advisories/kloxo-unauth-sqli-rce

Published

Jul 31, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-125117A stack-based buffer overflow vulnerability in the my_cgi.cg…9.8
• CVE-2014-125118A command injection vulnerability exists in the eScan Web Ma…9.4
• CVE-2014-125119A filename spoofing vulnerability exists in WinRAR when open…8.4
• CVE-2014-125120Rejected reason: This CVE has the been REJECTED and will not…
• CVE-2014-125121Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2…10
• CVE-2014-125122A stack-based buffer overflow vulnerability exists in the tm…5.3
• CVE-2014-125124An unauthenticated remote command execution vulnerability ex…10
• CVE-2014-125125A path traversal vulnerability exists in A10 Networks AX Loa…8.8
• CVE-2014-125126An unrestricted file upload vulnerability exists in Simple E…9.2
• CVE-2014-125127The mikecao/flight PHP framework in versions prior to v1.2 i…7.5
• CVE-2014-125128'sanitize-html' prior to version 1.0.3 is vulnerable to Cros…6.1
• CVE-2014-1252Double free vulnerability in Apple Pages 2.x before 2.1 and …