PT-2007-7337 · Hosting Controller · Hosting Controller

Publicado 2007-12-20 · Atualizado 2018-10-15 · CVE-2007-6503

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hosting Controller versions prior to 6.1 Hot fix 3.3

Description The issue allows remote authenticated users to import or change arbitrary plans. This can be achieved by sending a request to "hosting/importhostingplans.asp" to import a plan or to "hosting/AutoSignUpPlans.asp" with specific parameters, including save, 30, and d 30, to change a plan.

Recommendations For versions prior to 6.1 Hot fix 3.3, update to a version later than 6.1 Hot fix 3.3 to resolve the issue. As a temporary workaround, consider restricting access to the "hosting/importhostingplans.asp" and "hosting/AutoSignUpPlans.asp" endpoints to minimize the risk of exploitation. Additionally, avoid using the save, 30, and d 30 parameters in the "hosting/AutoSignUpPlans.asp" endpoint until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2007-6503

Produtos afetados

Hosting Controller

Referências · 8

• 🔥 http://securityfocus.com/bid/26862 · Exploit
• 🔥 https://exploit-db.com/exploits/4730 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39038 · Nota
• http://secunia.com/advisories/28973 · Nota
• http://securityfocus.com/archive/1/485028/100/0/threaded · Nota
• http://securitytracker.com/id?1019222 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6503 · Nota de Segurança
• http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html · Nota