Plesk 9.5.4 0-day

[Alin]

Just wanted to share what my inbox came across this morning

http://packetstormsecurity.com/files/download/121915/pleskwwwzeroday.rar

Kingcope 0-day for Plesk 9.5.4 - anyone tried it yet?

[Alin]

Just for the record, I can confirm that this is legit.

Took me some time to find a vulnerable server. If you want to give it a go 85.214.146.170 is vulnerable and you can find more using pnscan:

Code: [Select]

pnscan -w "GET /phppath/php HTTP/1.0\r\n\r\n" -r "500 Internal" <iprange>/<subnet> 80
Notice that not all of the results are positives.

[Stackprotector]

http://www.exploit-db.com/exploits/25986/
^ It is verified on exploit-db