Description
Directory traversal vulnerability in admin/deleteuser.php in HitHost 1.0.0 might allow remote attackers to delete directories (possibly only empty directories) via the $deleteuser variable. NOTE: the initial disclosure for this issue indicated that the researcher was unable to prove this issue; however, this might have been due to certain behaviors of rmdir.
References
- 19155 third-party-advisory
- hithost-deleteuser-directory-deletion(25106) vdb-entry
- 20060306 histhost v1.0.0 xss and possible rmdir mailing-list
- 20060314 Re: histhost v1.0.0 xss and possible rmdir mailing-list