CVE-2020-13166 EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 77.6% (pctl 100)
Patch early
A public exploit exists.
Description
The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 77.64% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-798 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2020-05-19 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| mylittletools | mylittleadmin |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Plesk/myLittleAdmin - ViewState .NET Deserialization (Metasploit) | 2020-05-25 |
References
- http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html
- https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/
- http://packetstormsecurity.com/files/157808/Plesk-myLittleAdmin-ViewState-.NET-Deserialization.html
- https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/
→ the Explorer · watch your stack · NVD