bugtraq - CPANEL Vuln : HTML injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040604034618.2751.qmail@www.securityfocus.com>
Date: 4 Jun 2004 03:46:18 -0000
From: qbann targ <web@...micrealms.com>
To: bugtraq@...urityfocus.com
Subject: CPANEL Vuln : HTML injection

Cpanel Resellers just can use an exploit in 
the /scripts/killacct to delete one of my other customers accounts(only the 
DNS info) not owned by him. All he had to do was create a fake account then 
delete it and look at the source code, view his cookies and 
discovered :2086/scripts/killacct?domain=(domain)&user=(user)&submit-
domain=Terminate . He ran it in his WHM with another of my customers domain 
and username and it deleted his name server entries. And of course his site 
won't show up anymore of course because of the dns info deleted. This would 
seem like a pretty serious error, correct me if I am wrong, but I think this 
issue should be addressed.

Discovered by : verb0s