PT-2006-5102 · Cpanel · Cpanel

Preth00Nker · Published 2006-08-22 · Updated 2018-10-17 · CVE-2006-4293

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel version 10

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploited via the dir parameter in "dohtaccess.html", or the file parameter in either "editit.html" or "showfile.html".

Recommendations For cPanel version 10, update to a version that includes a fix for these XSS vulnerabilities to prevent remote attackers from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the affected parameters dir and file in the respective HTML files until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2006-4293

Affected Products

Cpanel

References · 13

• 🔥 http://secunia.com/advisories/21592 · Exploit
• 🔥 https://exploit-db.com/exploits/28414 · Exploit
• 🔥 https://exploit-db.com/exploits/28415 · Exploit
• 🔥 https://exploit-db.com/exploits/28413 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-4293 · Security Note
• http://osvdb.org/28042 · Note
• http://securityreason.com/securityalert/1442 · Note
• http://osvdb.org/28043 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4293 · Note
• http://osvdb.org/28041 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28447 · Note
• http://securityfocus.com/archive/1/443637/100/0/threaded · Note
• http://securityfocus.com/bid/19624 · Note