bugtraq - Major Cpanel Expliot HTML Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040609040451.1913.qmail@www.securityfocus.com>
Date: 9 Jun 2004 04:04:51 -0000
From: Virtual Nova Web Hosting services virtualnova.net <verb0s@...tualnova.net>
To: bugtraq@...urityfocus.com
Subject: Major Cpanel Expliot HTML Injection

Major Bug found 6/7/04

Discovered by Verb0s 

Reseller accounts with cpanel, in the password modification page, can insert a basic injection ex:http://(domain):2086/scripts/passwd?password=<>&domain=<>&user=<>

The code will modify all the mysql database passwords, in which the reseller shouldnb't have permissions. From there, someone could take over someones site that may be sql based, on the same server as them. 

How to fix the problem:

After my immediate contact with cpanel. they updated and fixed all permission problems : 6/8/04

Update your Cpanel ASAP