medium6.0Public exploit code

CVE-2006-6198

Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HT…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

cPanel WebHost Manager 3.1 - 'park?ndomain' Cross-Site Scripting2006-11-25 · webapps · php · Verified
cPanel WebHost Manager 3.1 - 'dofeaturemanager?feature' Cross-Site Scripting2006-11-25 · webapps · php · Verified
cPanel WebHost Manager 3.1 - 'editzone?domain' Cross-Site Scripting2006-11-25 · webapps · php · Verified
cPanel WebHost Manager 3.1 - 'domts2?domain' Cross-Site Scripting2006-11-25 · webapps · php · Verified
cPanel WebHost Manager 3.1 - 'editpkg?pkg' Cross-Site Scripting2006-11-25 · webapps · php · Verified
cPanel WebHost Manager 3.1 - 'addon_configsupport.cgi?supporturl' Cross-Site Scripting2006-11-25 · webapps · php · Verified
cPanel WebHost Manager 3.1 - 'dochangeemail?email' Cross-Site Scripting2006-11-25 · webapps · php · Verified

Impact

Multiple cross-site scripting (XSS) vulnerabilities in cPanel WebHost Manager (WHM) 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) email parameter to (a) scripts2/dochangeemail, the (2) supporturl parameter to (b) cgi/addon_configsupport.cgi, the (3) pkg parameter to (c) scripts/editpkg, the (4) domain parameter to (d) scripts2/domts2 and (e) scripts/editzone, the (5) feature parameter to (g) scripts2/dofeaturemanager, and the (6) ndomain parameter to (h) scripts/park.

Affected products

Vendor	Product	Affected versions
Cpanel	Webhost Manager	Version 3.1.0

Public exploit code

Impact

Affected products

References