PT-2006-6250 · Cpanel · Cpanel

Crackers_Child · Published 2006-10-26 · Updated 2018-10-17 · CVE-2006-5535

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 10.8.0 through 10.9.0 R50

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the theme parameter to the "/scripts/dosetmytheme" API endpoint or the template parameter to the "/scripts2/editzonetemplate" API endpoint.

Recommendations For cPanel versions 10.8.0 through 10.9.0 R50, as a temporary workaround, consider restricting access to the "/scripts/dosetmytheme" and "/scripts2/editzonetemplate" API endpoints until a patch is available. Avoid using the theme and template parameters in these endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5535

Affected Products

Cpanel

References · 10

• 🔥 https://exploit-db.com/exploits/28844 · Exploit
• 🔥 http://securityfocus.com/bid/20683 · Exploit
• 🔥 https://exploit-db.com/exploits/28843 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5535 · Security Note
• http://secunia.com/advisories/22555 · Vendor Advisory
• http://changelog.cpanel.net · Patch
• http://vupen.com/english/advisories/2006/4190 · Note
• http://securityfocus.com/archive/1/449472/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5535 · Note
• http://securityreason.com/securityalert/1780 · Note