New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

Summary: cPanel disclosed on September 22 that a flaw in its CalDAV and CardDAV service lets anyone with a cPanel hosting account run code as root and take full control of the server, with no requirement beyond holding an account. A second bug in the WP Toolkit plugin lets a logged-in cPanel user make database modifications in other accounts, and a third flaw in the same calendar and contacts service lets a local user read other accounts' calendar events and contacts without changing them or gaining root.
Key Takeaway: On a shared server where accounts are sold to the public, the root flaw means any customer - or anyone who obtains a customer's login - could take over the whole machine, and cPanel offers no temporary workaround for servers that cannot be updated yet.

Read the original at The Hacker News ↗