[Full-disclosure] cPanel 10 File Editing Vulnerability

[Andrew Farmer]

On 04 Feb 06, at 09:16, Shell wrote:
> In cPanel 10, the script "erredit.html," which is supposed to edit  
> a specific set of files, can edit any file acessible by the cPanel.
>
> Example:
> http://www.example.com:2082/frontend/x/err/erredit.html? 
> dir=public_html/&file=index.php

Tested on a real cPanel system running cPanel 10.8.1-RELEASE. This  
won't edit files outside the user's home directory, even with  
traversal paths, and deletes files before writing them - this doesn't  
appear exploitable; indeed, it doesn't seem to be much except a weird  
way of editing your own files.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060204/ce8a3221/attachment.bin