Rob Brown has reported an security issue in cPanel, potentially allowing malicious users to escalate their privileges.

The problem is that cPanel compiles Apache and PHP with inappropriate options. This causes mod_php to use suexec in an insecure manner.

It is possible to execute arbitrary PHP code with the privileges of any other user, who has a publicly accessible PHP script, by supplying the path to a malicious script using "PATH_INFO".

Example:
http://[vulnerable_system]/~victim/any.php/~[malicious_user]/hack.php

This reportedly affects all versions of cPanel prior to 15th April when compiling Apache 1.3.29 and prior.

Solution
The problem does not occur when compiling Apache 1.3.30.

Provided and/or discovered by
Rob Brown, A-Squad.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area