The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
CVSS 2.0
Severity: MEDIUM
Problem Type: CWE-79,CWE-352,
Products Affected
| Vendor | Product | Version |
|---|---|---|
| infinitumit | directadmin | * |