4072 matches found
cPanel mod_php suEXEC Taint Vulnerability
SEVERITY: High, Arbitrary Execution as Arbitrary User PROBLEM DESCRIPTION: Flaws in how Apache's suexec binary has been patched by cPanel when configured for modphp, in conjuction with cPanel's creation of some perl scripts that are not taint clean, allow for any user to execute arbitrary code as...
cPanel 5-9 - Killacct Script Customer Account DNS Information Deletion
cPanel 5-9 - Killacct Script Customer Account DNS Information Deletion source: https://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by...
CPANEL Vuln : HTML injection
Cpanel Resellers just can use an exploit in the /scripts/killacct to delete one of my other customers accountsonly the DNS info not owned by him. All he had to do was create a fake account then delete it and look at the source code, view his cookies and discovered...
cPanel 5-9 - Killacct Script Customer Account DNS Information Deletion
source: https://www.securityfocus.com/bid/10468/info cPanel is prone to a vulnerability that can allow a remote authenticated administrator to delete customer account DNS information for customers that are not administered by that administrator. This attack can allow an attacker to cause a denial...
CVE-2004-0490
cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code...
CVE-2004-0490
CVE-2004-0490 affects cPanel when compiling Apache 1.3.29 with mod_phpsuexec; it does not set --enable-discard-path, so PHP uses SCRIPT_FILENAME instead of PATH_TRANSLATED, enabling local users to run the attacker’s script with the user’s privileges. This is a local vulnerability with complete co...
cPanel 5 9 - Local Privilege Escalation
cPanel 5 9 - Local Privilege Escalation source: https://www.securityfocus.com/bid/10407/info cPanel is reported prone to a privilege escalation vulnerability. It is reported that the options used by cPanel to compile Apache 1.3.29 and PHP using the modphpsuexec option are insecure. These settings...
cPanel mod_phpsuexec Vulnerability
Severity: High, Arbitrary Execution, Local Privilege Escalation Background: cPanel is a common web hosting management system written by cpanel.net installed on UNIX Operation Systems to help manage web, email, ftp, databases, and other administrative tasks. Problem Description: The options used b...
cPanel 5 < 9 - Local Privilege Escalation
source: https://www.securityfocus.com/bid/10407/info cPanel is reported prone to a privilege escalation vulnerability. It is reported that the options used by cPanel to compile Apache 1.3.29 and PHP using the modphpsuexec option are insecure. These settings will reportedly permit a local attacker...
Non-logged Brute Force Attack Vulnerability for Fantastico-Created Databases on cPanel Based Hosts
Advisory: cPanel/Fantastico/mysql local vulnerability Date: 5/19/04 By: Michael Curtis email at curto dot us System: Redhat Enterprise 3 ES / cPanel 9.3.0-R5 most likely all redhat versions with all cpanel versions Severity: High, full compromise of local databases, password retrieval Background:...
Exensive cPanel Cross Site Scripting
Description: cPanel 9.1.0-R85 is vulnerable to Cross Site Scripting XSS in almost every field which is returned to the browser. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the...
CVE-2004-1875
Multiple cross-site scripting XSS vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to testfile.html, 2 file parameter to erredit.html, 3 dns parameter to dnslook.html, 4 account parameter to ignorelist.html, 5 account...
CVE-2004-1849
Multiple cross-site scripting XSS vulnerabilities in cPanel 9.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 email parameter to dodelautores.html or 2 handle parameter to addhandle.html...
More Cpanel Vuls (cross site scripting)
Advisory Name: More Cpanel Vuls cross site scripting Discovered by: Fable Greets: 0x29A Crew, !AM Crew, Atomix, d3thstar, mgrd, rootthief.com. Version Tested On: cPanel Build 9.1.0-STABLE 93 Most likely effects more Description cPanel & WebHost Manager WHM is a next generation web hosting control...
cPanel fails to verify input passed to the "user" parameter
Overview A remotely exploitable vulnerability in CPanel's password reset and login scripts may allow a remote attacker to gain control of the vulnerable system. Description Cpanel is an application that provides the ability to manage accounts and provides an interface to the end users of web...
cPanel <= 9.1.0 Multiple Vulnerabilities
The version of cPanel installed on the remote host is version 9.1.0 or earlier and thus reportedly affected by multiple issues: - The dohtaccess.html script fails to sanitize input supplied by a user and is affected by a cross-site scripting vulnerability. CVE-2004-2308 - Both the Login Page and...
Cpanel 9.1.0 have a problem ?
Hi all I found another problem in login script http://www.xxx.com:2082/login/?user=|"id"| it same the first it give ROOT & u can use "+" or "20" without any problem : ! lool look @ this: / sh: /var/cpanel/users/: is a directory sh: uid=0root gid=0root...
Cpanel Request Lets Authenticated Users Conduct Cross-Site Scripting Attacks
Advisory Name: Cpanel Request Lets Authenticated Users Conduct Cross-Site Scripting Attacks Discovered by: Fable Greets: 0x29A Crew, !AM Crew, Atomix, d3thstar, mgrd, rootthief.com. Versions: ?? Description cPanel & WebHost Manager WHM is a next generation web hosting control panel system. Both...
cpanelroot.txt
Hi all when i tried to rest my pass i'm tried this url: http://cpanel.com:2082/resetpass/?user=|"ls"| it give me this / sh: line 1: /var/cpanel/users/: is a directory "sh: line 1: ls: command not found" Password Reset Resetting password for |"ls"|: A confirmation email has been sent to the email...
cPanel 5/6/7/8/9 - 'dir' Cross-Site Scripting
source: https://www.securityfocus.com/bid/9853/info It has been reported that cPanel may be prone to a cross-site scripting vulnerability that may allow a remote attacker to execute HTML or script code in a user's browser. The issue presents itself due to insufficient sanitization of user-supplie...