Lpanel 1.59 and previous versions, and other versions prior to 1.597, allows remote authenticated users to modify certain critical variables and (1) modify DNS settings for arbitrary domains via the domain parameter to diagnose.php, (2) close, open, or respond to arbitrary support tickets via the close, open, or pid parameter to view_ticket.php, (3) obtain sensitive information on arbitrary invoices via the inv parameter to viewreceipt.php, or (4) modify domain information for arbitrary domains via the editdomain parameter to domains.php.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
lpanel lpanel 1.594 |
||
lpanel lpanel 1.596 |
||
lpanel lpanel 1.59 |
||
lpanel lpanel 1.593 |
Vulmon