{"uuid": "47a6270c-872f-495d-8d9c-b4a210ea18a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-13166", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/plesk_mylittleadmin_viewstate.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Spencer McIntyre\", \"wvu \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a ViewState .NET deserialization vulnerability in\\n          web-based MS SQL Server management tool myLittleAdmin, for version 3.8\\n          and likely older versions, due to hardcoded  parameters in\\n          the web.config file for ASP.NET.\\n\\n          Popular web hosting control panel Plesk offers myLittleAdmin as an\\n          optional component that is selected automatically during \\\"full\\\"\\n          installation. This exploit caters to the Plesk target, though it\\n          should work fine against a standalone myLittleAdmin setup.\\n\\n          Successful exploitation results in code execution as the user running\\n          myLittleAdmin, which is IUSRPLESK_sqladmin for Plesk and described as\\n          the \\\"SQL Admin MSSQL anonymous account.\\\"\\n\\n          Tested on the latest Plesk Obsidian with optional myLittleAdmin 3.8.\", \"disclosure_date\": \"2020-05-15\", \"fullname\": \"exploit/windows/http/plesk_mylittleadmin_viewstate\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 16:12:31 +0000\", \"name\": \"Plesk/myLittleAdmin ViewState .NET Deserialization\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/windows/http/plesk_mylittleadmin_viewstate.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"windows/http/plesk_mylittleadmin_viewstate\", \"references\": [\"CVE-2020-13166\", \"URL-https://ssd-disclosure.com/ssd-advisory-mylittleadmin-preauth-rce/\", \"URL-https://portswigger.net/daily-swig/mylittleadmin-has-a-big-unpatched-security-flaw\"], \"rport\": 8401, \"session_types\": false, \"targets\": [\"Windows Command\", \"Windows Dropper\", \"PowerShell Stager\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:51:57.049645Z"}