Easy Hosting Control Panel Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Easy Hosting Control Panel (EHCP) version 20.04.1.b. This issue allows authenticated attackers to execute arbitrary JavaScript by manipulating the action parameter in the List MySQL Databases function.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, an authenticated user can send a request to the EHCP index.php file with the 'op' parameter set to 'domainop' and the 'action' parameter containing the injected JavaScript, such as a script tag including an alert function. The injected script will be executed in the user's browser, demonstrating the cross-site scripting vulnerability.