Easy Hosting control panel management verification bypass defect and repair

 

Title: Easy Hosting Control Panel Admin Auth Bypass

Author: Jasman www.2cto.com

: Https://launchpad.net/ehcp & http://www.ehcp.net

Affected Versions: 0.29.10-0.29.13

Test Platform: Ubuntu and Debian

 

Overview

Easy Hosting Control Panel designed for hosting of multiple domains on single machine.

It uses LAMP (LinuxApacheMysqlPhp). Its aim: easily installable, easy usage, non-complex, functional

 

Defects:

You can add ftp accounts and domain names without logon.

 

 

Http://www.bkjia.com/vhosts/ehcp /? Op = applyforaccount

Http://www.bkjia.com/vhosts/ehcp /? Op = applyforftpaccount

Http://www.bkjia.com/vhosts/ehcp /? Op = applyfordomainaccount

 

Example

Upload a shell via ftp

Http://www.bkjia.com/vhosts/[user name]/[domain]/httpdocs/shell. php

 

Test version

0.29.13

0.29.11

0.29.10

Fix: Verify

 

Thanks:

ArRay, 'yuda, N4ck0, K4pt3N, samu1241, bejamz, Gameover, antitos, yuki, pokeng,

Aphe_aphe, jos_ali_joe, BlueBoyz, JFry _, Ihsana 'lab, Anaski Crew, Forum. javasecrew

Exploit-Id, FeeLcoMz All Indonesian Hacker