Zend Software WHMPHP Multiple Security Vulnerabilities
BID:62707
Info
Zend Software WHMPHP Multiple Security Vulnerabilities
| Bugtraq ID: | 62707 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 18 2013 12:00AM |
| Updated: | Sep 18 2013 12:00AM |
| Credit: | Rack911 |
| Vulnerable: |
Zend Software WHMPHP 6.4 |
| Not Vulnerable: |
Zend Software WHMPHP 6.5 |
Discussion
Zend Software WHMPHP Multiple Security Vulnerabilities
WHMPHP is prone to multiple security vulnerabilities including:
1. A file-include vulnerability
2. An arbitrary command-execution vulnerability
3. A security-bypass vulnerability
An attacker can exploit these issues to execute arbitrary commands, obtain potentially sensitive information and execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
WHMPHP is prone to multiple security vulnerabilities including:
1. A file-include vulnerability
2. An arbitrary command-execution vulnerability
3. A security-bypass vulnerability
An attacker can exploit these issues to execute arbitrary commands, obtain potentially sensitive information and execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
Exploit / POC
Zend Software WHMPHP Multiple Security Vulnerabilities
Attackers can exploit these issues via a browser.
Attackers can exploit these issues via a browser.
References
Zend Software WHMPHP Multiple Security Vulnerabilities
References:
References:
- WHMPHP �?? Arbitrary Command Execution (R911-0070) (RACK911)
- WHMPHP �?? Insecure Credential Storage (R911-0069) (RACK911)
- WHMPHP �?? Local File Inclusion (R911-0068) (RACK911)
- WHMPHP Homepage (Zend Software)