Description
add_user.php in Virtual Hosting Control System (VHCS) 2.4.7.1 and earlier does not check user privileges when adding a new administrative user, which allows remote attackers to gain unauthorized access.
References
- 430 third-party-advisory
- vhcs-adduser-privilege-escalation(24667) vdb-entry
- 18799 third-party-advisory
- 20060211 RS-2006-1: Multiple flaws in VHCS 2.x mailing-list
- http://www.rs-labs.com/adv/RS-Labs-Advisory-2006-1.txt
- 16600 vdb-entry
- ADV-2006-0534 vdb-entry