Description
Multiple cross-site scripting (XSS) vulnerabilities in InterWorx Hosting Control Panel (InterWorx-CP) Webmaster Level (SiteWorx) 3.0.2 (1) allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php; and allow remote authenticated users to inject arbitrary web script or HTML via the PATH_INFO to (2) siteworx.php, (3) users.php, (4) ftp.php, (5) mysql.php, (6) domains.php, (7) htaccess.php, (8) scriptworx.php, (9) stats.php, (10) backup.php, (11) restore.php, and (12) httpd.php; and unspecified vectors to (13) cron.php and (14) prefs.php.
References
- 36778 vdb-entry
- 25451 vdb-entry
- 3070 third-party-advisory
- http://interworx.com/forums/showthread.php?t=2501
- 36772 vdb-entry
- 36775 vdb-entry
- 36771 vdb-entry
- 36776 vdb-entry
- 36773 vdb-entry
- 36780 vdb-entry
- 36779 vdb-entry
- 36768 vdb-entry
- 36774 vdb-entry
- http://www.hackerscenter.com/archive/view.asp?id=27884
- 26586 third-party-advisory
- 20070826 InterWorx-CP Multiple HTML Injections Vulnerabilitie mailing-list
- 36777 vdb-entry
- 36769 vdb-entry
- 36767 vdb-entry
- interworx-siteworx-multiple-file-include(36300) vdb-entry
- interworxcp-index-xss(36297) vdb-entry
- 36770 vdb-entry