Parallels

Symptoms

SQL injection vulnerability which allows to modify Plesk database.

Resolution

Please download the following file:

For Plesk 7.6.1

http://download1.swsoft.com/Plesk/Autoupdate/Windows/7.6.1/123413/auth.php3

For Plesk 8.1.0

http://download1.swsoft.com/Plesk/Autoupdate/Windows/8.1.0/123413/auth.php3

For Plesk 8.1.0.3

http://download1.swsoft.com/Plesk/Autoupdate/Windows/8.1.0.3/123413/auth.php3

For Plesk 8.1.1.2

http://download1.swsoft.com/Plesk/Autoupdate/Windows/8.1.1.2/123413/auth.php3

For Plesk 8.2

http://download1.swsoft.com/Plesk/Autoupdate/Windows/8.2.0/123413/auth.php3

and place it to %plesk_dir%\admin\auto_prepend folder.

Note: Please see how to install Plesk hotfixes properly.

No other additional actions are required. Plesk is secured now.

Additional information

Plesk versions below 7.6.1 must be upgraded to one of the latest versions and corresponding patch should be applied there.