verb0s has reported a vulnerability in cPanel, which can be exploited by certain, authenticated users to manipulate database passwords.

The problem is that reseller accounts can pass specially crafted code to the password modification page and thereby modify passwords for databases, which they shouldn't have access to.

Example:
http://[victim]:2086/scripts/passwd?password=<>&domain=<>&user=<>

Solution
The vendor has reportedly fixed the vulnerabilities on 2004-06-08.

Provided and/or discovered by
verb0s

Deep Links
Links available in Customer Area