CVE-2005-1654

Hosting Controller <6.1.9 - RCE

Title source: llm

Description

Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp with the loginname and password parameters set.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Mouse · textremotewindows

https://www.exploit-db.com/exploits/979

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by Silentium · cremotewindows

https://www.exploit-db.com/exploits/987

View Code ZIP pw:eip

References (2)

[Broken Link, Exploit, Patch] http://isun.shabgard.org/hc3.txt

[Broken Link] http://secunia.com/advisories/15271

Scores

EPSS 0.0212

EPSS Percentile 83.9%

Classification

CWE

CWE-425

Status draft

Affected Products (12)

hostingcontroller/hosting_controller < 6.1

hostingcontroller/hosting_controller

Timeline

Published May 18, 2005

Tracked Since Feb 18, 2026