PT-2014-2352 · Zpanel · Zpanel

Pcsjj · Published 2014-08-14 · Updated 2017-08-29 · CVE-2012-5683

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZPanel versions 10.0.1 and earlier

Description The issue allows remote attackers to hijack the authentication of administrators for requests, including creating new FTP users, conducting cross-site scripting (XSS) attacks, and conducting SQL injection attacks. This can be achieved through various actions and parameters, such as the CreateFTP action in the ftp management module, the inFullname parameter in an UpdateAccountSettings action in the my account module, and the inEmailAddress parameter in an UpdateClient action in the manage clients module.

Recommendations For ZPanel versions 10.0.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2012-5683

Affected Products

Zpanel

References · 7

• 🔥 http://exploit-db.com/exploits/22490 · Exploit
• 🔥 http://packetstormsecurity.com/files/117894/ZPanel-10.0.1-XSS-CSRF-SQL-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/22490 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-5683 · Security Note
• http://osvdb.org/show/osvdb/87140 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79838 · Note
• http://secunia.com/advisories/51172 · Note