DirectAdmin version 1.48 suffers from a cross site request forgery vulnerability.
a1a2a03a5ad46ca01cce7a7e5028a747d883d3be9fb3ab98b9963f200b51925a# Affected software: directadmin
# Type of vulnerability:ns hijacking via csrf
# URL:directadmin.com
# Discovered by: provensec
# Website: provensec.com
#version:1.48
# Proof of concept
https://www.directadmin.com:2222/CMD_ADMIN_SETTINGS
above age contains a form from which namesrvers can be changed which dont
have any csrf protection implemented attacker can leverage this to hijack
the domain by simple changing name server by sending crafted html page
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed