header-logo
Suggest Exploit
vendor:
cPanel
by:
Unknown
7.5
CVSS
HIGH
Remote SQL Injection
89
CWE
Product Name: cPanel
Affected Version From: Unknown
Affected Version To: Unknown
Patch Exists: No
Related CWE: Unknown
CPE: a:cpanel:cpanel
Metasploit:
Other Scripts:
Platforms Tested:
Unknown

cPanel Remote SQL Injection Vulnerability in passwd script

cPanel is affected by a remote SQL injection vulnerability in the passwd script. The issue occurs when user-supplied URI parameter input is not properly sanitized before being used in an SQL query. Malicious SQL statements can be passed to the passwd script through URI parameters, allowing a malicious user to influence database queries and potentially view or modify sensitive information.

Mitigation:

It is recommended to update to the latest version of cPanel to mitigate this vulnerability. Additionally, input validation and proper sanitization of user-supplied input should be implemented in the passwd script to prevent SQL injection attacks.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/10505/info

cPanel is reportedly affected by a remote SQL injection vulnerability in the passwd script. This issue is due to a failure of the application to properly sanitize user-supplied URI parameter input before using it in an SQL query.

The problem presents itself when malicious SQL statements are passed to the 'passwd' script through URI parameters.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

http://www.example.com:2086/scripts/passwd?password=<>&domain=<>&user=<>

Navigation

Suggest Exploit

Services By CQR