bugtraq - Plesk Control Panel <= 8.0.0 XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060716054243.1337.qmail@securityfocus.com>
Date: 16 Jul 2006 05:42:43 -0000
From: vuln.invent@...il.com
To: bugtraq@...urityfocus.com
Subject: Plesk Control Panel <= 8.0.0 XSS vulnerability

Product: Plesk control panel

Version: <= 8.0.0

Vendor: SWSoft Inc.

URL: http://www.swsoft.com/en/products/plesk/

VULNERABILITY CLASS: XSS

[Product Description]

Plesk is comprehensive server management software developed specifically for the Hosting Service Industry with the assistance of Web hosting professionals.

[Summary]

An attacker can exploit it by compromising the values of the parameter
"file" in filemanager.php.

This can be used to take advantage of the trust between a client and server 
allowing the malicious user to execute malicious JavaScript on 
the client's machine when client is logged into control panel.

[Exploit]

https://target.xxx:8443/filemanager/filemanager.php?cmd=chdir&file=<script>alert();</script>

[Credits]

INVENT