CVE-2007-6494 Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp with a username in the reseller parameter, followed by a request....
HighCVSS 10.0
EPSS 11.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Hosting Controller 6.1 Hot fix 3.3 and earlier allows remote attackers to obtain login access via a request to hosting/addreseller.asp with a username in the reseller parameter, followed by a request to AdminSettings/displays.asp with the DecideAction and ChangeSkin parameters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hosting controller | = 6.1_hotfix_3.3 | No fix listed |
References
- 44186 vdb-entry
- 3474 third-party-advisory
- 1019222 vdb-entry
- 20071213 Hosting Controller - Multiple Security Bugs (Extremely Critical) mailing-list
- 26862 exploit vdb-entry
- hostingcontroller-multiple-security-bypass(39038) vdb-entry
- 4730 exploit