Plesk Control Panel <= 8.0.0 XSS vulnerability

2006-07-24T00:00:00
ID SECURITYVULNS:DOC:13558
Type securityvulns
Reporter Securityvulns
Modified 2006-07-24T00:00:00

Description

Product: Plesk control panel

Version: <= 8.0.0

Vendor: SWSoft Inc.

URL: http://www.swsoft.com/en/products/plesk/

VULNERABILITY CLASS: XSS

[Product Description]

Plesk is comprehensive server management software developed specifically for the Hosting Service Industry with the assistance of Web hosting professionals.

[Summary]

An attacker can exploit it by compromising the values of the parameter "file" in filemanager.php.

This can be used to take advantage of the trust between a client and server allowing the malicious user to execute malicious JavaScript on the client's machine when client is logged into control panel.

[Exploit]

https://target.xxx:8443/filemanager/filemanager.php?cmd=chdir&file=<script>alert();</script>

[Credits]

INVENT