----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Hosting Controller Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA15975

VERIFY ADVISORY:
http://secunia.com/advisories/15975/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, Manipulation of data, Exposure of sensitive
information, Privilege escalation, DoS

WHERE:
>From remote

SOFTWARE:
Hosting Controller 6.x
http://secunia.com/product/4754/

DESCRIPTION:
Soroush Dalili and KeHieuHoc have discovered some vulnerabilities in
Hosting Controller, which can be exploited by malicious users to gain
knowledge of sensitive information, conduct SQL injection attacks,
cause a DoS (Denial of Service), or gain escalated privileges.

1) Input passed to the "searchtext" parameter in "iismanagerdb.asp"
and "accountmanager.asp", and the "ListReason" parameter in
"listreason.asp" isn't properly sanitised before being used in a SQL
query. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

2) Access to the "UpdateCreditLimit" action in "AccountActions.asp"
isn't properly restricted to privileged users. This can be exploited
to make unauthorised changes to credit limits and discount rate.

3) It is possible to cause the "inetinfo.exe" process to consume
large amount of CPU resources by accessing the "editplanopt3.asp",
"planmanager.asp", and "plansettings.asp" scripts directly or using
specific parameters.

4) Access to the "addsubsite_online.asp" script isn't properly
restricted to privileged users. This can be exploited by
non-privileged users to add accounts with higher privileges.

5) A design error in "dsp_newreseller.asp" can be exploited to gain
escalated privileges in the application by accessing the script
directly, then returning to the home page of the application.

The vulnerabilities have been confirmed in version 6.1 with hotfix
2.1. Prior versions may also be affected.

SOLUTION:
Edit the source code to ensure that input is properly sanitised and
verified.

PROVIDED AND/OR DISCOVERED BY:
1-3) Soroush Dalili, GrayHatz Security Group
4-5) KeHieuHoc, HCE GROUP

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------