ZPanel 10.1.1 allows XSS via the HTTP Host header to the etc/static/diskexceeded/index.php URI.

zpanel / zpanelx

ZPanel is a web hosting control panel written in PHP for Windows and *NIX host OS's.

http://www.zpanelcp.com

Other

415 stars 296 forks source link

Open nullr00tbyte opened 5 years ago

nullr00tbyte commented 5 years ago

I Found a XSS Vulnerability that allow execute HTML, JS code via the HTTP Host header

echo $_SERVER['HTTP_HOST'] whitout sanitize in /etc/static/diskexceeded/index.php and other files