CPanel Multiple Cross-Site Scripting Vulnerabilities
BID:19624
CVE-2006-4293 |Info
CPanel Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 19624 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 21 2006 12:00AM |
| Updated: | Aug 22 2006 04:54PM |
| Credit: | Preth00nker is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
cPanel cPanel 10.8.2 118 cPanel cPanel 10.8.1 113 cPanel cPanel 10.8.1 (build 84) cPanel cPanel 10.6 .0-R137 cPanel cPanel 10.2 .0-R82 cPanel cPanel 10 |
| Not Vulnerable: | |
Discussion
CPanel Multiple Cross-Site Scripting Vulnerabilities
cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input.
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Exploit / POC
CPanel Multiple Cross-Site Scripting Vulnerabilities
These issues can be exploited through a web-client.
The following proof-of-concept URIs are available.
These issues can be exploited through a web-client.
The following proof-of-concept URIs are available.
Solution / Fix
CPanel Multiple Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.