Executive brief
MineAdmin, a web-based administrative dashboard, contains a critical security flaw in its scheduled tasks feature. Attackers can exploit insecure default credentials or weak permissions to gain administrative access and execute malicious commands on the underlying server. This could lead to a complete takeover of the application, theft of sensitive data, or a total service outage.
Technical details
MineAdmin versions prior to 3.0 are vulnerable to Remote Code Execution (RCE) due to insecure permissions in the 'Scheduled Tasks' component. The vulnerability is exacerbated by the presence of default administrative credentials (superAdmin/admin123). An attacker who gains access to the administrative interface can navigate to the 'Add Scheduled Task' form and inject malicious PHP code (e.g., using eval() or system() functions) into the task definition. When the task is executed, the payload is triggered on the server. This is classified as Improper Control of Generation of Code (CWE-94). Users are advised to upgrade to version 3.0 or later and change default passwords immediately.
Affected products
- MineAdmin MineAdmin < 3.0
Timeline
- 2025-12-12: disclosed: Initial disclosure via GitHub Gist and NVD publication.
- 2025-12-19: advisory: NVD enrichment and CPE configuration added.