PT-2007-7337 · Hosting Controller · Hosting Controller

Published 2007-12-20 · Updated 2018-10-15 · CVE-2007-6503

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Hosting Controller versions prior to 6.1 Hot fix 3.3

Description The issue allows remote authenticated users to import or change arbitrary plans. This can be achieved by sending a request to "hosting/importhostingplans.asp" to import a plan or to "hosting/AutoSignUpPlans.asp" with specific parameters, including save, 30, and d 30, to change a plan.

Recommendations For versions prior to 6.1 Hot fix 3.3, update to a version later than 6.1 Hot fix 3.3 to resolve the issue. As a temporary workaround, consider restricting access to the "hosting/importhostingplans.asp" and "hosting/AutoSignUpPlans.asp" endpoints to minimize the risk of exploitation. Additionally, avoid using the save, 30, and d 30 parameters in the "hosting/AutoSignUpPlans.asp" endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-6503

Affected Products

Hosting Controller

References · 8

• 🔥 http://securityfocus.com/bid/26862 · Exploit
• 🔥 https://exploit-db.com/exploits/4730 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6503 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39038 · Note
• http://secunia.com/advisories/28973 · Note
• http://securityfocus.com/archive/1/485028/100/0/threaded · Note
• http://securitytracker.com/id?1019222 · Note
• http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html · Note