The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER, CMD_SHOW_USER, and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this, and take over the administration panel.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://numanozdemir.com/respdisc/directadmin.pdf | Exploit Third Party Advisory Broken Link |
| https://www.exploit-db.com/exploits/46694 | Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html | Exploit Third Party Advisory VDB Entry |
| https://numanozdemir.com/respdisc/directadmin.pdf | Exploit Third Party Advisory Broken Link |
| https://www.exploit-db.com/exploits/46694 | Exploit Third Party Advisory VDB Entry |
Configurations
History
16 Dec 2025, 21:13
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 6.8
v3 : 6.1 |
| CPE | cpe:2.3:a:directadmin:directadmin:*:*:*:*:*:*:*:* | |
| References | () https://numanozdemir.com/respdisc/directadmin.pdf - Exploit, Third Party Advisory, Broken Link | |
| First Time |
Directadmin
Directadmin directadmin |
21 Nov 2024, 04:20
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/152494/DirectAdmin-1.561-Cross-Site-Scripting.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://numanozdemir.com/respdisc/directadmin.pdf - Exploit, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/46694 - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2019-04-30 19:29
Updated : 2025-12-16 21:13
NVD link : CVE-2019-11193
Mitre link : CVE-2019-11193
CVE.ORG link : CVE-2019-11193
JSON object : View
Products Affected
directadmin
- directadmin