PT-2004-2774 · Cpanel · Cpanel

Published 2004-03-30 · Updated 2017-07-11 · CVE-2004-1875

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cPanel version 9.1.0-R85 cPanel versions prior to 10

Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters, including the email parameter to "testfile.html", the file parameter to "erredit.html", the dns parameter to "dnslook.html", the account parameter to "ignorelist.html" and "showlog.html", the db parameter to "repairdb.html", the login parameter to "doaddftp.html", the account parameter to "editmsg.htm", and the ip parameter to "del.html".

Recommendations For cPanel version 9.1.0-R85, avoid using the vulnerable parameters in the specified API endpoints until a fix is available. As a temporary workaround, consider restricting access to the affected endpoints, such as "testfile.html", "erredit.html", "dnslook.html", "ignorelist.html", "showlog.html", "repairdb.html", "doaddftp.html", "editmsg.htm", and "del.html", to minimize the risk of exploitation. For versions prior to 10, apply the same restrictions as for version 9.1.0-R85.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2004-1875

Affected Products

Cpanel

References · 21

• 🔥 https://exploit-db.com/exploits/29071 · Exploit
• http://osvdb.org/4215 · Vendor Advisory
• http://securityfocus.com/bid/10002 · Vendor Advisory
• http://osvdb.org/4243 · Vendor Advisory
• http://osvdb.org/4210 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4658 · Vendor Advisory
• http://secunia.com/advisories/11244 · Vendor Advisory
• http://secunia.com/advisories/22984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1875 · Security Note
• http://osvdb.org/4212 · Vendor Advisory
• http://cirt.net/advisories/cpanel_xss.shtml · Vendor Advisory
• http://osvdb.org/4209 · Vendor Advisory
• http://osvdb.org/4214 · Vendor Advisory
• http://osvdb.org/4213 · Vendor Advisory
• http://osvdb.org/4208 · Vendor Advisory