major_rls51.txt

MajorSecurity Advisory 51Virtual Hosting Control System - Session fixation Issue Details ======= Product: Virtual Hosting Control System Affected version: 2.4.7.1 and prior Remote-Exploit: yes Vendor-URL: http://www.vhcs.net Vendor-Status: informed Advisory-Status: published Credits ============...

phpauction.txt

---------------------------------------------------------- Aria-Security.net Advisory Discovered by: l2odon Gr33t to: A.u.r.a & O.U.T.L.A.W & R@1D3N @ DrtRp & Cl0wn ----------------------------------------------------------- Software: PHP-Auction Vendor: http://www.vhcs.net Attack method: SQL...

VHCS login.php check_login() Function Authentication Bypass

The remote host is running VHCS, a control panel for hosting providers. The GUI portion of the version of VHCS installed on the remote host does not halt script execution if 'checklogin' fails. An attacker can leverage this flaw to bypass authentication and access VHCS application scripts that...

VHCS include/sql.php include_path Parameter Remote File Inclusion

The remote host is running VHCS, a control panel for hosting providers. The GUI portion of the version of VHCS installed on the remote host fails to sanitize input to the 'includepath' parameter of the 'include/sql.php' script before using it to include PHP code. Provided PHP's 'registerglobals'...

vhcsXSS.txt

---------------------------------------------------------- Aria-Security.net Advisory Discovered by: O.U.T.L.A.W Gr33t to: A.u.r.a & R@1D3N & Smok3r ----------------------------------------------------------- Software: VHCS Link: http://www.vhcs.net Attack method: Cross Site Scripting...

CVE-2006-2174

Multiple cross-site scripting XSS vulnerabilities in admin/serverdaystats.php in Virtual Hosting Control System VHCS allow remote attackers to inject arbitrary web script or HTML via the 1 day, 2 month, or 3 year parameter...

CVE-2006-2174

CVE-2006-2174 concerns multiple cross-site scripting (XSS) vulnerabilities in VHCS’s admin/server_day_stats.php. The issue allows remote attackers to inject arbitrary web script or HTML by supplying one of three parameters: day, month, or year. This is documented across multiple sources (NVD, CVE...

CVE-2006-2174

Multiple cross-site scripting XSS vulnerabilities in admin/serverdaystats.php in Virtual Hosting Control System VHCS allow remote attackers to inject arbitrary web script or HTML via the 1 day, 2 month, or 3 year parameter...

VHCS --- Virtual Hosting Control System Cross Site Scripting

---------------------------------------------------------- Aria-Security.net Advisory Discovered by: O.U.T.L.A.W www.Aria-security.net Gr33t to: A.u.r.a & R@1D3N & Smok3r ----------------------------------------------------------- Software: VHCS Link: http://www.vhcs.net Attack method: Cross Site...

VHCS <= 2.4.7.1 (Add User) Authentication Bypass Exploit

No description provided by source. html head titleVHCS version = 2.4.7.1 PoC. By RoMaNSoFt/title script language="JavaScript" function submitform if document.adminadduser.username.value=='admin' alert'Learn to read before launching an exploit, script-kiddie!'; exit;...

VHCS 2.4.7.1 - Add User Authentication Bypass

VHCS 2.4.7.1 - Add User Authentication Bypass VHCS version function submitform if document.adminadduser.username.value=='admin' alert'Learn to read before launching an exploit, script-kiddie!'; exit; document.adminadduser.action=document.adminadduser.target.value; document.adminadduser.submit; VH...

VHCS 2.4.7.1 - Add User Authentication Bypass

VHCS version function submitform if document.adminadduser.username.value=='admin' alert'Learn to read before launching an exploit, script-kiddie!'; exit; document.adminadduser.action=document.adminadduser.target.value; document.adminadduser.submit; VHCS version Target URL /vhcs2/admin/adduser.php...

VHCS <= 2.4.7.1 (Add User) Authentication Bypass Exploit

Exploit for unknown platform in category web applications ======================================================== VHCS VHCS version function submitform if document.adminadduser.username.value=='admin' alert'Learn to read before launching an exploit, script-kiddie!'; exit;...

CVE-2006-0686

adduser.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access...

Design/Logic Flaw

adduser.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access...

Cross site scripting

Cross-site scripting XSS vulnerability in Virtual Hosting Control System VHCS 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator uses the admin log...

CVE-2006-0685

The checklogin function in login.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access...

CVE-2006-0684

changepassword.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not verify the old password when a user changes the password, which may allow remote attackers to gain unauthorized access...

CVE-2006-0683

Cross-site scripting XSS vulnerability in Virtual Hosting Control System VHCS 2.4.7.1 with v.1 patch and earlier allows remote attackers to inject arbitrary web script or HTML via the username, which is recorded in a log file but not properly handled when the administrator uses the admin log...

Authentication flaw

The checklogin function in login.php in Virtual Hosting Control System VHCS 2.4.7.1 and earlier does not exit when authentication fails, which allows remote attackers to gain unauthorized access...