Román Medina-Heigl Hernández has reported some vulnerabilities in VHCS, which can be exploited by malicious people to conduct script insertion attacks, and by malicious users to bypass certain security restrictions and gain escalated privileges.

1) Input passed to the username field in the login page isn't sanitised before being stored in the admin log. This can be exploited to execute arbitrary HTML and script code in the Administrators' browser session in context of an affected website when the Administrator views the log in the "Admin Log" functionality.

The vulnerability has been reported in version 2.4.6.2 and 2.4.7.1. Prior versions may also be affected.

2) The gui/admin/change_password.php script does not validate user's current password before allowing the password to be changed.

The security issue has been reported in version 2.4.6.2 and 2.4.7.1. Prior versions may also be affected.

3) The "check_login()" function in gui/include/login.php does not properly terminate the script when user session validation fails. This can be exploited to bypass session validation in certain scripts such as admin/add_user.php, which may be exploited to added admin users.

The vulnerability has been reported in version 2.4.6.2 and 2.4.7.1. Prior versions may also be affected.

4) The gui/admin/add_user.php script does not validate user's rights before allowing admin users to be added. This may be exploited by less privileged users to add new admin user to the system.

The vulnerability has been reported in version 2.4.6.2 and 2.4.7.1. Prior versions may also be affected.

Solution
Apply Security Patch 2006-02-09.
Further details available in Customer Area

Provided and/or discovered by
Román Medina-Heigl Hernández

Changelog
Further details available in Customer Area

Original Advisory
http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt

Deep Links
Links available in Customer Area