Info

Disclosure

Mar 13, 2004

Discovery

Mar 12, 2004

Dates

Exploit

Mar 13, 2004

Solution

Unknown

Description

cPanel contains a flaw that allows a remote attacker to access arbitrary files. The issue is due to the erredit.html script not properly validating the "dir" and "file" variables. If an attacker requests an arbitrary file under the right configuration, it will be displayed.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality, Loss of Integrity
Exploit: Exploit Public
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Currently, there are no known upgrades, patches, or workarounds available to correct this issue.

Products

cPanel, Inc.

cPanel

9.1.0-RELEASE 57

References

Other Advisory URL: http://www.cirt.net/advisories/cpanel_file.shtml

Credit

Sullo - sullocirt.net - cirt.net

Direct URL: http://osvdb.org/36218