WHM AutoPilot Account Cancellation Access Validation Vulnerability

Bugtraq ID:	15483
Class:	Access Validation Error
CVE:	CVE-2005-3687
Remote:	Yes
Local:	No
Published:	Nov 17 2005 12:00AM
Updated:	Jul 12 2009 05:56PM
Credit:	"Agna Zilchi" <[email protected]> disclosed this vulnerability.
Vulnerable:	WHM Autopilot WHM Autopilot 2.5.20 WHM Autopilot WHM Autopilot 2.5 .0 WHM Autopilot WHM Autopilot 2.4.7 WHM Autopilot WHM Autopilot 2.4.6 .5 WHM Autopilot WHM Autopilot 2.4.6 WHM Autopilot WHM Autopilot 2.4.5
Not Vulnerable:

WHM AutoPilot Account Cancellation Access Validation Vulnerability

WHM AutoPilot is a commercial script designed to aid in the administration of Web-hosting environments.

WHM AutoPilot is susceptible to an account cancellation access validation vulnerability. This issue is due to a failure of the application to ensure that cancellation requests from users are performed only by authorized users.

This vulnerability allows attackers to issue cancellation requests for arbitrary users, potentially causing a denial of service situation as targeted Web hosting accounts are inadvertently disabled.

Versions 2.5.20 and prior are affected by this issue.

WHM AutoPilot Account Cancellation Access Validation Vulnerability

An exploit is not required.

WHM AutoPilot Account Cancellation Access Validation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

WHM AutoPilot Account Cancellation Access Validation Vulnerability

References:

• WHM AutoPilot Homepage (WHM AutoPilot)