PT-2014-2352 · Zpanel · Zpanel

Pcsjj · Publicado 2014-08-14 · Atualizado 2017-08-29 · CVE-2012-5683

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZPanel versions 10.0.1 and earlier

Description The issue allows remote attackers to hijack the authentication of administrators for requests, including creating new FTP users, conducting cross-site scripting (XSS) attacks, and conducting SQL injection attacks. This can be achieved through various actions and parameters, such as the CreateFTP action in the ftp management module, the inFullname parameter in an UpdateAccountSettings action in the my account module, and the inEmailAddress parameter in an UpdateClient action in the manage clients module.

Recommendations For ZPanel versions 10.0.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2012-5683

Produtos afetados

Zpanel

Referências · 7

• 🔥 http://exploit-db.com/exploits/22490 · Exploit
• 🔥 http://packetstormsecurity.com/files/117894/ZPanel-10.0.1-XSS-CSRF-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/22490 · Exploit
• http://osvdb.org/show/osvdb/87140 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5683 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79838 · Nota
• http://secunia.com/advisories/51172 · Nota