Description

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that allows unauthenticated remote attackers to execute arbitrary commands as root by bypassing authentication through specific parameter combinations. Attackers can deserialize a crafted billing_data POST field and inject shell payloads through the uid field, which is passed unmodified to proc_open() via vexec(), yielding complete control of the host and all managed VPS instances.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-22T18:17:14.357Z",
  "pubdate": "2026-09-22T18:17:14.357Z",
  "executiveSummary": "Softaculous Virtualizor versions prior to 3.2.9 (Patch 9) and 3.0.0 contain a critical OS command injection vulnerability within the billing module handler. This flaw permits unauthenticated remote attackers to bypass authentication mechanisms by manipulating specific POST parameters.\nThe vulnerability originates from insecure deserialization and improper neutralization of user-supplied input. By crafting a malicious 'billing_data' POST payload, an attacker can inject arbitrary shell commands into the 'uid' field, which the application subsequently executes with root privileges via the 'vexec()' function and 'proc_open()'.\nThis vulnerability grants attackers complete control over the host server and all managed Virtual Private Servers (VPS). Due to the lack of required authentication and the high privilege level of the execution, this represents a maximum-severity security risk. Successful exploitation allows for full system compromise, data exfiltration, and total control over the virtualization environment.",
  "technicalDetails": "The vulnerability exists within the Virtualizor billing module handler, which fails to adequately sanitize input before passing it to system-level execution functions. The flaw is primarily rooted in the insecure handling of the 'billing_data' POST parameter, which is subject to deserialization without prior validation or integrity checks.\nThe attack flow begins when an unauthenticated remote attacker submits a crafted HTTP POST request to the target system. By injecting a serialized object into the 'billing_data' field, the attacker manipulates the internal state of the application's billing module. Specifically, the 'uid' field within this data structure is utilized as a vector for command injection.\nUpon processing the request, the application passes the 'uid' value to the 'vexec()' internal function, which further interfaces with the PHP 'proc_open()' function. Because the input is passed to these functions without sufficient filtering or parameterization, shell metacharacters can be used to terminate the intended command and append arbitrary system instructions.\nThe 'vexec()' function is responsible for executing backend shell operations required for managing VPS infrastructure. By injecting malicious payloads into the 'uid' parameter, an attacker effectively gains the ability to execute commands with root-level context. Since the web service or the underlying management framework executes these calls with elevated privileges, the payload runs as root.\nThe impact of this vulnerability is total system compromise. Once the command injection is successful, an attacker can deploy backdoors, exfiltrate sensitive configuration files, modify Virtualizor settings, or compromise all guest VPS instances hosted on the platform. The exploit bypasses standard authentication checks, allowing for silent remote exploitation of the virtualization controller.\nThe vulnerable code path involves the insecure consumption of serialized data which influences the logic flow in the billing handler. Versions 3.0.0 through 3.2.9 (pre-patch 9) are definitively affected. The exploitation requires no prior authentication, meaning it is accessible to any attacker with network reach to the Virtualizor control panel interface."
}