PT-2006-6645 · Helm · Helm Web Hosting Control Panel

Published 2006-11-20 · Updated 2018-10-17 · CVE-2006-5984

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Helm Web Hosting Control Panel version 3.2.10

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The affected parameters include txtCompanyName, txtEmail, txtUserAccNum, and setThemeColour. The vulnerable API endpoints are "users.asp" and "default.asp" at the Reseller, Admin, and User levels.

Recommendations For Helm Web Hosting Control Panel version 3.2.10, consider restricting access to the txtCompanyName, txtEmail, txtUserAccNum, and setThemeColour parameters in the affected API endpoints "users.asp" and "default.asp" until a patch is available. As a temporary workaround, avoid using these parameters in the Reseller, Admin, and User levels to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-5984

Affected Products

Helm Web Hosting Control Panel

References · 9

• http://secunia.com/advisories/22916 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-5984 · Security Note
• http://aria-security.net/advisory/helm.txt · Vendor Advisory
• http://securitytracker.com/id?1017240 · Note
• http://vupen.com/english/advisories/2006/4557 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30309 · Note
• http://securityfocus.com/archive/1/451848/100/200/threaded · Note
• http://securityreason.com/securityalert/1884 · Note
• http://securityfocus.com/archive/1/451737/100/0/threaded · Note