PT-2008-3560 · Cpanel · Cpanel

Michael Brooks · Published 2008-05-01 · Updated 2017-08-08 · CVE-2008-2043

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 11.18.3 through 11.19.3

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities. These vulnerabilities allow remote attackers to execute arbitrary code and perform various administrative actions. Specifically, the vulnerabilities can be exploited through the following API endpoints: "frontend/x2/cron/editcronsimple.html" by manipulating the command1 parameter, "frontend/x2/sql/adddb.html", "frontend/x2/sql/adduser.html", and "frontend/x2/ftp/doaddftp.html".

Recommendations For cPanel versions 11.18.3 through 11.19.3, consider restricting access to the mentioned API endpoints as a temporary workaround until a patch is available. Avoid using the command1 parameter in the "frontend/x2/cron/editcronsimple.html" endpoint until the issue is resolved. Restrict access to the "frontend/x2/sql/adddb.html", "frontend/x2/sql/adduser.html", and "frontend/x2/ftp/doaddftp.html" endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-2043

Affected Products

Cpanel

References · 7

• 🔥 http://rooksecurity.com/blog/?p=7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2043 · Security Note
• http://secunia.com/advisories/30027 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2043 · Note
• http://kb.cert.org/vuls/id/584089 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42114 · Note
• http://vupen.com/english/advisories/2008/1401/references · Note