CVE-2006-5983

Name of the Vulnerable Software and Affected Versions DirectAdmin version 1.28.1

Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved through various parameters and commands, including the user parameter to CMD SHOW RESELLER or CMD SHOW USER in the Admin level, the TYPE parameter to CMD TICKET CREATE or CMD TICKET, the user parameter to CMD EMAIL FORWARDER MODIFY, CMD EMAIL VACATION MODIFY, or CMD FTP SHOW in the User level, and the name parameter to CMD EMAIL LIST in the User level, or the user parameter to CMD SHOW USER in the Reseller level.

Recommendations For version 1.28.1, consider disabling the affected commands, such as CMD SHOW RESELLER, CMD SHOW USER, CMD TICKET CREATE, CMD TICKET, CMD EMAIL FORWARDER MODIFY, CMD EMAIL VACATION MODIFY, CMD FTP SHOW, and CMD EMAIL LIST, until a patch is available. Restrict access to the vulnerable parameters, including user and TYPE, to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.