Hosting Controller Multiple Vulnerabilities

Bugtraq ID:	13806
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	May 28 2005 12:00AM
Updated:	May 28 2005 12:00AM
Credit:	Discovery is credited to Soroush Dalili from GrayHatz Security Group.
Vulnerable:	Hosting Controller Hosting Controller 6.1 Hotfix 2.0 Hosting Controller Hosting Controller 6.1 Hotfix 1.9 Hosting Controller Hosting Controller 6.1 Hotfix 1.7 Hosting Controller Hosting Controller 6.1 Hotfix 1.4 Hosting Controller Hosting Controller 6.1
Not Vulnerable:

Hosting Controller Multiple Vulnerabilities

Hosting Controller is reported prone to multiple vulnerabilities. These issues can allow an attacker gain unauthorized access to data and carry out SQL injection attacks.

These issues reportedly affect Hosting Controller 6.1 HotFix 2.0 and prior versions.

Hosting Controller Multiple Vulnerabilities

An exploit is not required.

The following example URIs were provided:

http://www.example.com/admin/hosting/plandetails.asp?hostcustid=[PlanID]

http://www.example.com/admin/hosting/resellerresources.asp?action=2&jresourceid=1%20or%201=1

Hosting Controller Multiple Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Hosting Controller Multiple Vulnerabilities

References:

• Hosting Controller 'resellerresources.asp' (SecurityTracker)
  
• Hosting Controller Homepage (Hosting Controller)