I.Vulnerability H-Sphere Hosting Control Panel Cross Site Scripting Vulnerability II.Vendor Positive Software (www.psoft.net) III.Affected Systems * H-Sphere (<= 2.4.3 Patch 8) IV.About H-Sphere is a scalable multiserver web hosting control panel that provides complete hosting automation for Linux, BSD & Win2000/2003 platforms, is easy to use, and has extensive user interface, billing solution, brandable resellers, and integrated trouble ticket system. V.Description H-Sphere prints login variable in login page without a security control. It's possible to inject malicious HTML and JavaScript codes to login page by modifying this variable. An example link provided below. VI.Exploit http://cp.example.com/psoft/servlet/psoft.hsphere.CP?action=login&login=[XSS ] VII.Vulnerability Status * Vulnerability discovered on 2005-12-29. * Vendor notified on 2006-01-02. * Vendor responded on 2006-01-09. * Patch released on 2006-01-12. VIII.Workarounds * Upgrade you system to H-Sphere 2.4.3 Patch 9. Patch 9 is available at http://www.psoft.net/HSdocumentation/versions/index.php?v=243p9&p=r IX.Credits M.Neset KABAKLI Wakiza Software Technologies neset{at}wakiza{dot}com www.wakiza.com
