Re: cPanel 10 File Editing Vulnerability

[Andrew Farmer <andfarm () gmail com>]

On 04 Feb 06, at 09:16, Shell wrote:
> In cPanel 10, the script "erredit.html," which is supposed to edit  
> a specific set of files, can edit any file acessible by the cPanel.
>
> Example:
> http://www.example.com:2082/frontend/x/err/erredit.html? 
> dir=public_html/&file=index.php

Tested on a real cPanel system running cPanel 10.8.1-RELEASE. This  
won't edit files outside the user's home directory, even with  
traversal paths, and deletes files before writing them - this doesn't  
appear exploitable; indeed, it doesn't seem to be much except a weird  
way of editing your own files.

Attachment: PGP.sig
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/