← back
CVE-2004-1875

CVE-2004-1875

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 4.6%
from disclosure to weapon556 days
Published on NVDMay 10
1st PoC+556d
exploitation probability
4.6%top 9% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html. NOTE: the dnslook.html vector was later reported to exist in cPanel 10.
Affected products
n/a · n/a
public PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29071
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://marc.info/?l=bugtraq&m=108066561608676&w=2http://secunia.com/advisories/11244http://secunia.com/advisories/22984https://exchange.xforce.ibmcloud.com/vulnerabilities/15671http://www.aria-security.com/forum/showthread.php?t=30http://www.cirt.net/advisories/cpanel_xss.shtmlhttp://www.osvdb.org/4208http://www.osvdb.org/4209http://www.osvdb.org/4210http://www.osvdb.org/4211http://www.osvdb.org/4212http://www.osvdb.org/4213