Parallels knowledgebase (KB) http://kb.parallels.com/ Parallels knowledgebase (KB) en Copyright 2008 Parallels Wed, 10 Sep 2008 00:00:00 +0600 Wed, 10 Sep 2008 00:00:00 +0600 rt-team@parallels.com <![CDATA[[FIX] SQL Injection vulnerability]]> http://kb.parallels.com/en/2169

[FIX] SQL Injection vulnerability

Article ID: 2169 
Last Review: Feb,12 2009
Author: Eugene Bazarov
Last updated by: Hildreth Norohna APPLIES TO:
  • Parallels Plesk Panel

Symptoms

SQL injection vulnerability within Plesk for Linux/Unix.

 

 



Resolution

For other Plesk versions please download the following file:

For Plesk v8.0.0 and v8.0.1 :

http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.0.1/114298/class.Session.php
MD5 (class.Session.php) = 4d917ed483cbf030fb122a1e214b2bbf

For Plesk v8.1.0 :

http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.1.0/114298/class.Session.php
MD5 (class.Session.php) = 4de3b2fc50011d27fb13e5a293720100

For Plesk 8.2.0 :

http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.2.0/114298/class.Session.php
MD5 (class.Session.php) = 5b7a8071374aa94b83697aec72d1d556

and replace /usr/local/psa/admin/plib/class.Session.php file on Plesk server with the downloaded new one. Make sure that md5sum and permissions of the file are correct, for example:


# wget http://download1.swsoft.com/Plesk/Hotfix/PleskUnix/8.2.0/114298/class.Session.php

# md5sum  ./class.Session.php
MD5 (./class.Session.php) = 5b7a8071374aa94b83697aec72d1d556

# cp /usr/local/psa/admin/plib/class.Session.php /usr/local/psa/admin/plib/class.Session.php.old

# cp ./class.Session.php /usr/local/psa/admin/plib/class.Session.php

# chmod 644 /usr/local/psa/admin/plib/class.Session.php

# chown root:psaadm /usr/local/psa/admin/plib/class.Session.php

# /usr/local/psa/admin/bin/httpsdctl restart


Subscription for changes to this article Subscription for changes to this article
]]> Eugene Bazarov 6288 LastUpdated: 2009-02-12 13:36:52 2009-02-12 13:31:33