PT-2019-12174 · Infinitumit · Directadmin

CVE-2019-11193 · Publicado 2019-04-30 · Atualizado 2025-12-16

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions InfinitumIT DirectAdmin versions prior to v1.561

Description The issue concerns the FileManager in InfinitumIT DirectAdmin, where an attacker can exploit XSS via CMD FILE MANAGER, CMD SHOW USER, and CMD SHOW RESELLER. This allows the attacker to bypass CSRF protection and potentially take over the administration panel.

Recommendations For versions prior to v1.561, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the FileManager and its associated commands to minimize the risk of exploitation.

Exploit

Correção

CSRF

XSS

Enumeração de Fraquezas

CWE-352

CWE-79

Identificadores relacionados

CVE-2019-11193

Produtos afetados

Directadmin

Referências · 6

• 🔥 https://exploit-db.com/exploits/46694 · Exploit
• 🔥 https://numanozdemir.com/respdisc/directadmin.pdf · Exploit
• 🔥 http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11193 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11193 · Nota de Segurança
• https://t.me/cveNotify/146019 · Publicação no Telegram