QwikSec

Security Database

CVE

CWE

Training

CVE-2007-6497

Published: Dec 20, 2007

Modified: Aug 7, 2024

PUBLISHED

Description

Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and (2) allows remote authenticated users to change a credit amount and increase a discount via an UpdateUser action to Accounts/AccountActions.asp with modified UserName, FullName, CreditLimit, and DefaultDiscount parameters, a related issue to CVE-2005-2219.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

third-party-advisory

x_refsource_SECUNIA

20071213 Hosting Controller - Multiple Security Bugs (Extremely Critical)

mailing-list

x_refsource_BUGTRAQ

http://hostingcontroller.com/english/logs/Post-Hotfix-3_3-sec-Patch-ReleaseNotes.html

x_refsource_CONFIRM

third-party-advisory

x_refsource_SREASON

exploit

x_refsource_EXPLOIT-DB

vdb-entry

x_refsource_BID

vdb-entry

x_refsource_SECTRACK

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.