Secunia

Some vulnerabilities have been discovered in Hosting Controller, which can be exploited by malicious users to gain knowledge of sensitive information, modify data, or conduct SQL injection attacks.

1) Access to the "planmanagerstep1.asp" script isn't properly restricted. This can be exploited by non-privileged users to add a plan to the database.

2) Access to the "editplanopt1.asp" script isn't properly restricted. This can be exploited by non-privileged users to make unauthorised changes to the plans in the database.

3) Input passed to the "hostcustid" parameter of "plandetails.asp" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

4) Access to the "IISActions.asp" script isn't properly restricted. This can be exploited by non-privileged users to add domains with unlimited quota.

5) Input passed to certain parameters in the forgot password option isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

6) An authenticated user can disable scripting for any website on the server.

The vulnerabilities have been confirmed in version 6.1 with hotfix 2.2. Prior versions may also be affected.

Solution
Apply Hotfix 2.3.
Further details available in Customer Area

Provided and/or discovered by
1-4) Soroush Dalili, GrayHatz Security Group.
5-6) Reported by vendor.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area