Vulnerable Systems:
* WHM AutoPilot version 2.5.20 and prior
A vulnerability leading to unauthorized cancellation requests has been found.
The "c" GET variable sent to /cancel_account.php is not verified to ensure that the currently logged in user owns the account specified by the base 64 encoded integer value (the ID of the hosting account one wishes to cancel).
An attacker with an account in a WHMAP installation could file cancellation requests for hosting accounts that do not belong to the attacker's account.
In the worst case these cancellation requests would be processed by the authority running WHMAP, and the targeted hosting accounts would be canceled.
Workaround:
There is no known workaround at this time.
Disclosure Timeline:
Discovered: November 16, 2005
Vendor Notified: November 17, 2005
Public Release: November 17, 2005
