Easy Hosting Control Panel Admin Auth Bypass

vendor:

Easy Hosting Control Panel

by:

Jasman

7.5

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: Easy Hosting Control Panel

Affected Version From: 0.29.10

Affected Version To: 0.29.13

Patch Exists: YES

Related CWE: N/A

CPE: a:ehcp:ehcp

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu, Debian

2011

Easy Hosting Control Panel Admin Auth Bypass

Easy Hosting Control Panel (EHC) is designed for hosting of multiple domains on single machine. It uses LAMP(LinuxApacheMysqlPhp). Its aim:easily installable,easy usage, non-complex,functional. To add a ftp account & domain does not require a login. An attacker can exploit this vulnerability by uploading a shell via ftp to http://site.com/vhosts/[username]/[domain]/httpdocs/shell.php

Mitigation:

Ensure that authentication is required for all administrative functions.

Source

Exploit-DB raw data:

# Exploit Title: Easy Hosting Control Panel Admin Auth Bypass
# Google Dork: inurl:/ehcp/?op=applyfordomainaccount
# Date: 10/04/2011
# Author: Jasman
# Software Link: https://launchpad.net/ehcp & http://www.ehcp.net
# Version: 0.29.10 - 0.29.13
# Tested on: Ubuntu, Debian


+ Description
Easy Hosting Control Panel designed for hosting of multiple domains on single machine.
It uses LAMP(LinuxApacheMysqlPhp). Its aim:easily installable,easy usage, non-complex,functional


+ Vulnerable:
to add a ftp account & domain does not require a login.

http://site.com/vhosts/ehcp/?op=applyforaccount
http://site.com/vhosts/ehcp/?op=applyforftpaccount
http://site.com/vhosts/ehcp/?op=applyfordomainaccount

+ Exploit 
upload a shell via ftp
http://site.com/vhosts/[username]/[domain]/httpdocs/shell.php

+ Tested On
0.29.13
0.29.11
0.29.10


+ Other Link:
https://bugs.launchpad.net/ehcp/+bug/865889


+ Thank to:
ArRay,`yuda, N4ck0, K4pt3N, samu1241, bejamz, Gameover, antitos, yuki, pokeng, 
aphe_aphe, jos_ali_joe, BlueBoyz, JFry_, Ihsana'Lab, Anaski Crew, Forum.ExploreCrew
Exploit-Id, FeeLcoMz All Indonesian Hacker