PT-2018-17671 · Unknown · Easy Hosting Control Panel

Hyp3Rlinx · Publicado 2018-05-11 · Atualizado 2019-10-03 · CVE-2018-6617

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel (EHCP) version 0.37.12.b

Description The issue allows attackers to change passwords of arbitrary database users when using a local MySQL server. This is due to the failure to ask for the current password, which enables unauthorized password changes.

Recommendations For Easy Hosting Control Panel (EHCP) version 0.37.12.b, consider implementing a mechanism to request the current password before allowing changes to database user passwords as a temporary workaround. Restrict access to the database user management functionality to minimize the risk of exploitation.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-6617

Produtos afetados

Easy Hosting Control Panel

Referências · 4

• 🔥 http://packetstormsecurity.com/files/147558/Easy-Hosting-Control-Panel-0.37.12.b-Unverified-Password-Change.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-UNVERIFIED-PASSWORD-CHANGE.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6617 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6617 · Aviso do Fabricante