PT-2019-12174 · Infinitumit · Directadmin

Published 2019-04-30 · Updated 2025-12-16 · CVE-2019-11193

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions InfinitumIT DirectAdmin versions prior to v1.561

Description The issue concerns the FileManager in InfinitumIT DirectAdmin, where an attacker can exploit XSS via CMD FILE MANAGER, CMD SHOW USER, and CMD SHOW RESELLER. This allows the attacker to bypass CSRF protection and potentially take over the administration panel.

Recommendations For versions prior to v1.561, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the FileManager and its associated commands to minimize the risk of exploitation.

Exploit

Fix

CSRF

XSS

Weakness Enumeration

CWE-352

CWE-79

Related Identifiers

CVE-2019-11193

Affected Products

Directadmin

References · 6

• 🔥 https://exploit-db.com/exploits/46694 · Exploit
• 🔥 https://numanozdemir.com/respdisc/directadmin.pdf · Exploit
• 🔥 http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-11193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11193 · Security Note
• https://t.me/cveNotify/146019 · Telegram Post