----------------------------------------------------------------------

Monitor, Filter, and Manage Security Information
- Filtering and Management of Secunia advisories
- Overview, documentation, and detailed reports
- Alerting via email and SMS

Request Trial:
https://ca.secunia.com/?f=l

----------------------------------------------------------------------

TITLE:
Hosting Controller Disclosure of Information

SECUNIA ADVISORY ID:
SA14522

VERIFY ADVISORY:
http://secunia.com/advisories/14522/

CRITICAL:
Less critical

IMPACT:
Exposure of system information, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Hosting Controller 6.x
http://secunia.com/product/4754/

DESCRIPTION:
Mouse and Hamid Kashfi have reported two security issues in Hosting
Controller, which can be exploited by malicious people to disclose
some potentially sensitive information.

1) The problem is that the site updates log is placed inside the web
root. This can e.g. be exploited to disclose all domain names hosted
on a vulnerable server.

Example:
http://[victim]/admin/logs/HCDiskQuotaService.csv

2) An error in the password recovery feature in the admin login page
can be exploited to disclose hosting owners mail addresses.

Successful exploitation requires that the owner's domain name is
known.

A combination of the two security issues can be combined to disclose
mail addresses of all hosting owners.

The security issues have been reported in version 6.1 (hotfix 1.7).
Other versions may also be affected.

SOLUTION:
The security issues have reportedly been fixed and will be available
in an upcoming patch.

PROVIDED AND/OR DISCOVERED BY:
Mouse and Hamid Kashfi

ORIGINAL ADVISORY:
http://isun.shabgard.org/hc2.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------