PT-2005-2752 · Hosting Controller · Hosting Controller

Published 2005-05-27 · Updated 2008-09-05 · CVE-2005-1784

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Hosting Controller versions 6.1 HotFix 2.0 and earlier

Description The issue allows remote attackers to steal passwords and gain privileges. This is achieved by modifying the emailaddress parameter in an updateprofile action for UserProfile.asp.

Recommendations For Hosting Controller versions 6.1 HotFix 2.0 and earlier, consider restricting access to the updateprofile action in UserProfile.asp to minimize the risk of exploitation. Avoid using the emailaddress parameter in the affected action until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2005-1784

Affected Products

Hosting Controller

References · 3

• 🔥 https://exploit-db.com/exploits/1015 · Exploit
• 🔥 http://securitytracker.com/id?1014062 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1784 · Security Note