CVE-2024-40579

Assume the container has been deployed and linked in WHMCS using Virtuozzo Hybrid Server For WHMCS v 1.7.1

File: virtuozzo_hybrid_server_1.7.1_whmcs_opensource/modules/servers/virtuozzoVPS/pages/clientarea.php

Edit container’s hostname in client area:

Example Payload of XSS:

That’s it. The script is now stored and will be executed when the module fetches the container’s data.

There is a lack of sanitisation/ No validation on the POST request: (Variables have been modified)

            $va1 = [
                ...
                'var' => $_POST['var']
                ...
            ];