Some vulnerabilities have been reported in ScriptsFrenzy.com Host Directory Pro, which can be exploited by malicious people to disclose certain sensitive information or to bypass certain security restrictions.

1) An error in the authentication process can be exploited by malicious people to disclose certain sensitive information.

For more information:
SA23500

2) A vulnerability is caused due to improper access restriction of the administrator pages. This can be exploited to bypass the authentication mechanism and gain access to administrative pages by setting a specially crafted "adm" cookie.

3) A vulnerability is caused due to improper access restriction of the "admin/config" script. This can be exploited to e.g. change the administrator's password by sending specially crafted requests to the script.

Solution
Restrict access to the administration section e.g. with a firewall.

Provided and/or discovered by
1) hack2prison
2) Crackers_Child
3) TiGeR-Dz

Changelog
Further details available in Customer Area

Original Advisory
2) http://milw0rm.com/exploits/5476
3) http://milw0rm.com/exploits/8879

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area