Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

Bugtraq ID:	49937
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 04 2011 12:00AM
Updated:	Oct 04 2011 12:00AM
Credit:	Jasman
Vulnerable:	EHCP Easy Hosting Control Panel 0.29.13 EHCP Easy Hosting Control Panel 0.29.12 EHCP Easy Hosting Control Panel 0.29.10 EHCP Easy Hosting Control Panel 0.29.11
Not Vulnerable:

Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

Easy Hosting Control Panel is prone to a security-bypass vulnerability.

Attackers could exploit the issue to add arbitrary FTP accounts to the affected application.

Easy Hosting Control Panel versions 0.29.10 up to and including 0.29.13 are vulnerable.

Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/vhosts/ehcp/?op=applyforaccount
http://www.example.com/vhosts/ehcp/?op=applyforftpaccount
http://www.example.com/vhosts/ehcp/?op=applyfordomainaccount

Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Easy Hosting Control Panel FTP Account Security Bypass Vulnerability

References:

• Vendor Homepage (EHCP)