Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Hosting Controller 6.1 Hot fix 3.3 and earlier (1) allows remote attackers to change arbitrary user profiles via a request to Hosting/Addreseller.asp with modified loginname and email parameters; and (2) allows remote authenticated users to change a credit amount and increase a discount via an UpdateUser action to Accounts/AccountActions.asp with modified UserName, FullName, CreditLimit, and DefaultDiscount parameters, a related issue to CVE-2005-2219.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Hosting Controller 多个权限许可和访问控制漏洞
Vulnerability Description
Hosting Controller (1)远程攻击者可以借助对修改登录名和email参数的Hosting/Addreseller.asp的一个请求改变任意用户描述；以及(2) allows 远程验证用户改变信用保障金额和增加折扣可以借助对Accounts/AccountActions.asp的一个更新用户的操作，该操作可以修改UserName, FullName, CreditLimit,和DefaultDiscount参数。
CVSS Information
N/A
Vulnerability Type
N/A