plesk800.txt

`Product: Plesk control panel  
  
Version: <= 8.0.0  
  
Vendor: SWSoft Inc.  
  
URL: http://www.swsoft.com/en/products/plesk/  
  
VULNERABILITY CLASS: XSS  
  
[Product Description]  
  
Plesk is comprehensive server management software developed specifically for the Hosting Service Industry with the assistance of Web hosting professionals.  
  
[Summary]  
  
An attacker can exploit it by compromising the values of the parameter  
"file" in filemanager.php.  
  
This can be used to take advantage of the trust between a client and server   
allowing the malicious user to execute malicious JavaScript on   
the client's machine when client is logged into control panel.  
  
[Exploit]  
  
https://target.xxx:8443/filemanager/filemanager.php?cmd=chdir&file=<script>alert();</script>  
  
[Credits]  
  
INVENT  
`