WebPros WP Squared vulnerabilities

WebPros cPanel and WHM Authentication Bypass via Login Flow

WebPros · cPanel

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Webpros · cPanel

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Webpros · cPanel

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Webpros · cPanel

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

WebPros · cPanel

HTTP Smuggling in cPanel allows potential leak of credentials.

WebPros · cPanel

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

WebPros · cPanel

Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.

WebPros · cPanel

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

WebPros · cPanel

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

WebPros · cPanel

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header…

WebPros · cPanel