Description
clogin.php in Benchmark Designs' WHM AutoPilot 2.4.5 and earlier allows remote attackers to obtain plaintext username and password credentials by using the clogin_e and base64_encode functions to encode the desired user ID in the c parameter, then read the plaintext values in the resulting form.
References
- 10846 vdb-entry
- whmautopilot-clogin-gain-access(16849) vdb-entry
- 8279 vdb-entry
- 12200 third-party-advisory
- 1010833 vdb-entry
- 20040802 Benchmark Designs' WHM Autopilot backdoor vulnerability to plain-text password. mailing-list