Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
BID:35316
Info
Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
| Bugtraq ID: | 35316 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jun 04 2009 12:00AM |
| Updated: | Jun 15 2009 08:19PM |
| Credit: | Anonymous |
| Vulnerable: |
Lxlabs Kloxo Hosting Platform 5.75 |
| Not Vulnerable: | |
Discussion
Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
Lxlabs Kloxo Hosting Platform (formerly known as Lxadmin) is prone to multiple security vulnerabilities, including security-bypass, information-disclosure, cross-site scripting, SQL-injection, denial-of-service, command-injection, and insecure-file-creation issues.
Attackers can exploit these issues to bypass security measures, overwrite sensitive files, interact with the underlying database, steal authentication credentials, or perform other attacks. To exploit these issues, an attacker must have local access to an affected computer or must be logged in to the application. In some cases, attackers may completely compromise a computer running this application.
Kloxo Hosting Platform 5.75 is vulnerable; other versions may also be affected.
Lxlabs Kloxo Hosting Platform (formerly known as Lxadmin) is prone to multiple security vulnerabilities, including security-bypass, information-disclosure, cross-site scripting, SQL-injection, denial-of-service, command-injection, and insecure-file-creation issues.
Attackers can exploit these issues to bypass security measures, overwrite sensitive files, interact with the underlying database, steal authentication credentials, or perform other attacks. To exploit these issues, an attacker must have local access to an affected computer or must be logged in to the application. In some cases, attackers may completely compromise a computer running this application.
Kloxo Hosting Platform 5.75 is vulnerable; other versions may also be affected.
Exploit / POC
Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
Reports indicate that these issues are being actively exploited.
To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user into visiting a malicious URI. To exploit some of these issues, attackers require local, interactive access to a vulnerable computer. Some of these issues may be exploited via a browser or other readily available tools.
The following document describes some techniques and examples for exploiting these issues:
Reports indicate that these issues are being actively exploited.
To exploit a cross-site scripting issue, an attacker must entice an unsuspecting user into visiting a malicious URI. To exploit some of these issues, attackers require local, interactive access to a vulnerable computer. Some of these issues may be exploited via a browser or other readily available tools.
The following document describes some techniques and examples for exploiting these issues:
Solution / Fix
Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Lxlabs Kloxo Hosting Platform Multiple Security Vulnerabilities
References:
References:
- Vendor Homepage (Lxlabs)