Bugtraq mailing list archives
CPANEL Vuln : HTML injection
From: qbann targ <web () atomicrealms com>
Date: 4 Jun 2004 03:46:18 -0000
Cpanel Resellers just can use an exploit in the /scripts/killacct to delete one of my other customers accounts(only the DNS info) not owned by him. All he had to do was create a fake account then delete it and look at the source code, view his cookies and discovered :2086/scripts/killacct?domain=(domain)&user=(user)&submit- domain=Terminate . He ran it in his WHM with another of my customers domain and username and it deleted his name server entries. And of course his site won't show up anymore of course because of the dns info deleted. This would seem like a pretty serious error, correct me if I am wrong, but I think this issue should be addressed. Discovered by : verb0s
Current thread:
- CPANEL Vuln : HTML injection qbann targ (Jun 04)