Soroush Dalili has discovered two vulnerabilities in Hosting Controller, which can be exploited by malicious users to conduct SQL injection attacks.

Input passed to the "IP" parameter in "/AdminSettings/IPManager.asp" and the "GatewayID" parameter in "/AdminSettings/AddGatewaySettings.asp" isn't properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Successful exploitation requires user to be authenticated as a reseller.

The vulnerabilities have been confirmed in version 6.1 (Hotfix 2.8). Other versions may also be affected.

Solution
Apply Hotfix 3.2.
Further details available in Customer Area

Provided and/or discovered by
Soroush Dalili, GrayHatz Security Group

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area