PT-2006-6250 · Cpanel · Cpanel

Crackers_Child · Publicado 2006-10-26 · Atualizado 2018-10-17 · CVE-2006-5535

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 10.8.0 through 10.9.0 R50

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the theme parameter to the "/scripts/dosetmytheme" API endpoint or the template parameter to the "/scripts2/editzonetemplate" API endpoint.

Recommendations For cPanel versions 10.8.0 through 10.9.0 R50, as a temporary workaround, consider restricting access to the "/scripts/dosetmytheme" and "/scripts2/editzonetemplate" API endpoints until a patch is available. Avoid using the theme and template parameters in these endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-5535

Produtos afetados

Cpanel

Referências · 10

• 🔥 https://exploit-db.com/exploits/28844 · Exploit
• 🔥 http://securityfocus.com/bid/20683 · Exploit
• 🔥 https://exploit-db.com/exploits/28843 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5535 · Nota de Segurança
• http://vupen.com/english/advisories/2006/4190 · Nota
• http://securityfocus.com/archive/1/449472/100/0/threaded · Nota
• http://secunia.com/advisories/22555 · Aviso do Fabricante
• http://changelog.cpanel.net · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5535 · Nota
• http://securityreason.com/securityalert/1780 · Nota