PT-2018-17671 · Unknown · Easy Hosting Control Panel

Hyp3Rlinx · Published 2018-05-11 · Updated 2019-10-03 · CVE-2018-6617

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easy Hosting Control Panel (EHCP) version 0.37.12.b

Description The issue allows attackers to change passwords of arbitrary database users when using a local MySQL server. This is due to the failure to ask for the current password, which enables unauthorized password changes.

Recommendations For Easy Hosting Control Panel (EHCP) version 0.37.12.b, consider implementing a mechanism to request the current password before allowing changes to database user passwords as a temporary workaround. Restrict access to the database user management functionality to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-6617

Affected Products

Easy Hosting Control Panel

References · 4

• 🔥 http://packetstormsecurity.com/files/147558/Easy-Hosting-Control-Panel-0.37.12.b-Unverified-Password-Change.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/EHCP-v0.37.12.b-UNVERIFIED-PASSWORD-CHANGE.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-6617 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6617 · Vendor Advisory