imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as (1) ftp, (2) owwwPath, and (3) oftpPath.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Hosting_controller | Hosting_controller | 1.1 (including) | 1.1 (including) |
| Hosting_controller | Hosting_controller | 1.3 (including) | 1.3 (including) |
| Hosting_controller | Hosting_controller | 1.4 (including) | 1.4 (including) |
| Hosting_controller | Hosting_controller | 1.4.1 (including) | 1.4.1 (including) |
| Hosting_controller | Hosting_controller | 1.4b (including) | 1.4b (including) |
References
- http://archives.neohapsis.com/archives/bugtraq/2002-05/0142.html
- http://www.iss.net/security_center/static/9105.php
- http://www.securityfocus.com/bid/4761
- http://archives.neohapsis.com/archives/bugtraq/2002-05/0142.html
- http://www.iss.net/security_center/static/9105.php
- http://www.securityfocus.com/bid/4761