Vulnerability CVE-2005-1932
Published: 2005-07-05   Modified: 2012-02-12

Description:
Lpanel 1.59 and earlier, and other versions before 1.597, allows remote authenticated users to modify certain critical variables and (1) modify DNS settings for arbitrary domains via the domain parameter to diagnose.php, (2) close, open, or respond to arbitrary support tickets via the close, open, or pid parameter to view_ticket.php, (3) obtain sensitive information on arbitrary invoices via the inv parameter to viewreceipt.php, or (4) modify domain information for arbitrary domains via the editdomain parameter to domains.php.

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Lpanel -> Lpanel 

 References:
http://www.securityfocus.com/bid/13869
http://www.lpanel.net/changelog.php
http://secunia.com/advisories/15589/
http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034419.html
http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034418.html
http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034417.html
http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034416.html
http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034415.html
http://lists.grok.org.uk/pipermail/full-disclosure/2005-June/034414.html
Copyright 2024, cxsecurity.com

 

Back to Top