Arab VieruZ has discovered a vulnerability in cPanel, allowing malicious people to execute certain system commands on a vulnerable system.

The problem is that user input passed to the "user" parameter in the "resetpass" section isn't properly verified before being used. This can be exploited to inject various commands by supplying shell meta characters.

The vulnerability affects builds on all platforms up to and including version 9.1.0 build 34.

Solution
The vendor advises users of STABLE and RELEASE branches to disable the "Allow cPanel users to reset their password via email" feature in the WebHostManager.
Further details available in Customer Area

Provided and/or discovered by
Arab VieruZ

Changelog
Further details available in Customer Area

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area