full-disclosure - cPanel 10 File Editing Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sun Feb  5 00:51:10 2006
From: andfarm at gmail.com (Andrew Farmer)
Subject: cPanel 10 File Editing Vulnerability

On 04 Feb 06, at 09:16, Shell wrote:
> In cPanel 10, the script "erredit.html," which is supposed to edit  
> a specific set of files, can edit any file acessible by the cPanel.
>
> Example:
> http://www.example.com:2082/frontend/x/err/erredit.html? 
> dir=public_html/&file=index.php

Tested on a real cPanel system running cPanel 10.8.1-RELEASE. This  
won't edit files outside the user's home directory, even with  
traversal paths, and deletes files before writing them - this doesn't  
appear exploitable; indeed, it doesn't seem to be much except a weird  
way of editing your own files.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060204/ce8a3221/PGP.bin