BoxBilling authenticated RCE (CVE-2022-3552)

CVE-2022-3552 is an authenticated remote code execution in BoxBilling (≤ 4.22.1.5), a PHP billing and client-management system. The flaw lies in how the admin panel handles certain fields that it ends up deserializing or evaluating server-side: an attacker with an admin session can inject a payload (for example, a serialized PHP object or code in a field processed without sanitization) and force its execution, obtaining a shell as the web-service user.

The "authenticated" part is key: you must first arrive with valid admin credentials. In practice those credentials usually leak beforehand (an exposed .git with bb-config.php, password reuse, default values). With them, the public exploit logs in and delivers the shell:

python3 CVE-2022-3552.py --domain http://<host>/ -u 'admin@<host>' -p '<password>'

Its output confirms the flow: Successfully logged in, Payload saved successfully, Getting Shell, and the inbound connection lands on the listener right after.

Why it happens. The panel trusts client-side data and processes it insecurely; an administrator (legitimate or impersonated) can turn that trust into RCE. Conceptually it sits close to a command injection or a web RCE: user-controlled input the server executes.

How to detect it. The chain starts with an administrator login (sometimes from an IP outside the usual range) followed by a request that saves a field with a serialized PHP object (O:<n>:"...": with gadget classes) or code, something normal panel operation does not send. On the host, the definitive signature is process lineage: the web server (php-fpm/apache, as www-data) spawning sh/bash as a child after that POST, followed by an outbound connection to the attacker's listener. An admin saving configuration and the server immediately opening a shell is the chain.

Defence. Upgrade BoxBilling above the affected version, protect .git and config files in the document root, do not reuse passwords and limit accounts with admin-panel access.