CPanel BoxTrapper Manage.HTML Cross-Site Scripting Vulnerability

Bugtraq ID:	21497
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 08 2006 12:00AM
Updated:	Dec 08 2006 07:34PM
Credit:	The Aria-Security Team is credited with the discovery of this vulnerability.
Vulnerable:	cPanel cPanel 11
Not Vulnerable:

CPanel BoxTrapper Manage.HTML Cross-Site Scripting Vulnerability

cPanel BoxTrapper is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

cPanel 11 is vulnerable to this issue; other versions may also be affected.

CPanel BoxTrapper Manage.HTML Cross-Site Scripting Vulnerability

An attacker can trigger this vulnerability by enticing a victim user to follow a malicious URI.

An example URI has been provided:

http://www.example.com/frontend/xtest/mail/manage.html?account=

CPanel BoxTrapper Manage.HTML Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any solutions for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

CPanel BoxTrapper Manage.HTML Cross-Site Scripting Vulnerability

References:

• cPanel Homepage (cPanel)
  
• [Aria-Security Team] cPanel BoxTrapper Cross Site Scripting ([email protected])