Vendor: Morgan Harvey
Version: <= 2.6.1
CVE: CVE-2005-1444 CVE-2005-1445 CVE-2005-1446 CVE-2005-1447
OSVDB: 16262 16263 16264 16265 16266 16267 16268
SitePanel2 is a helpdesk / trouble ticket / support system used by businesses and individuals alike. There are a number of vulnerabilities in SitePanel2, some of which are fairly serious. If an attacker is able to successfully exploit these vulnerabilities in SitePanel2 he may be able to successfully compromise user accounts or completely compromise the target web server. A security patch has been released to address these issues and all users are strongly encouraged to upgrade their SitePanel2 installations as soon as possible.
Cross Site Scripting:
Cross site scripting exists in SitePanel2. This vulnerability exists due to user supplied input not being checked properly.
This vulnerability could be used to steal cookie based authentication credentials within the scope of the current domain, or render hostile code in a victim's browser.
Arbitrary File Deletion:
I found an arbitrary file deletion issue, which depending on server permissions may allow an attacker to delete any file on the server.
Even if the server is running as nobody you can still delete any and all attachments you know the name of.
Directory Traversal Vulnerability:
Also, there is a directory traversal vulnerability. An attacker may specify directory traversal sequences when calling the "lang" parameter and include arbitrary files residing on the local machine.
This issue can be used to read arbitrary files, or include and execute arbitrary local files.
Arbitrary File Upload:
Nothing very technical here, but an attacker can upload malicious files such as php scripts when attaching them to a trouble ticket and execute them with the privledges of the target web server.
Arbitrary File Include Vulnerability:
SitePanel2 is prone to both remote and local file include vulnerabilities which may allow for an attacker to execute arbitrary commands on the victim webserver by including malicious files.
Above is an example of how this issue could be exploited. The problem lies in the way the "p" parameter is called. It is clearly not sanatized and can be used to include arbitrary files from a remote location.
The developer was contacted some months ago and a new version can be found here http://forum.sitepanel2.com/index.php?showtopic=271
James Bercegay of the GulfTech Security Research Team